Development timeline key to linking Stuxnet, Flame malware

30.05.2012
Nailing down a timeline for the development of Flame, the new super-cyber spying malware recently found infecting PCs in Iran and other Middle Eastern countries, will be critical to connecting the dots between it, Stuxnet and Duqu, experts said today.

Flame, as the espionage tool has been named, is a -- 20 to 40 times larger than Stuxnet -- that infiltrates networks, scouts out the digital landscape, then uses a variety of modules to pilfer information.

What researchers are trying to determine is not only how Flame works -- an effort that will take months -- but how it fits with other malware that experts believe targeted Iran, a country at odds with the West over its nuclear program.

In particular, two earlier-discovered threats: Stuxnet, which most have concluded was created to sabotage Iran's uranium-enrichment facilities, and Duqu, an intelligence-gathering tool many believe was used to pinpoint targets for Stuxnet.

"The most interesting thing about Flame is its possible relationship to Stuxnet," said Roel Schouwenberg, a senior researcher with Moscow-based antivirus company Kaspersky Lab. "The timelines [of the two] will play a big part in any analysis."

Liam O Murchu, director of operations for Symantec's security response center, agreed. "The timeline is very important," said O Murchu.