Malware Flame was considered dead after its discovery by experts from the Kaspersky Lab in 2012. The mentioned virus is a complex toolkit designed for espionage on a national scale. After its public exposure, the operators of Flame attempted to cover their tracks by destroying evidence of the virus's presence on infected computers, most of which were located in the Middle East and North Africa.
Now, specialists from Chronicle Security, part of Alphabet, have managed to discover traces of a modified version of Flame. It is believed that the trojan was actively used by attackers from 2014 to 2016. Researchers say that the attackers did not destroy the malware but rather re-engineered it, making it more complex and less detectable by security measures.
Additionally, specialists found traces of the sophisticated malware Stuxnet, which was used in 2007 to sabotage Iran's nuclear program. Experts believe that Stuxnet and Flame share common features, indicating a possible connection in their origins. It is thought that Flame was developed in Israel and the USA and that the malware was used for espionage. Notably, at the time of its discovery, Flame was the first modular platform, allowing components to be replaced based on the characteristics of the attacked system.
Researchers now possess new tools that help identify traces of past attacks, shedding light on some of them. As a result, files compiled in early 2014 were discovered, about a year and a half after Flame's exposure. It is noted that at that time, none of the antivirus programs identified these files as malicious. The modular trojan has numerous functions that facilitate espionage activities. For example, it can activate the microphone on an infected device to record conversations happening nearby.
Žiaľ, výskumníci nedokázali odhaliť celý potenciál Flame 2.0, aktualizovanej verzie nebezpečného trójskeho koníka. Na jej ochranu sa použilo šifrovanie, ktoré odborníkom zabránilo podrobne preskúmať jednotlivé komponenty. Preto otázka o možnostiach a spôsoboch šírenia Flame 2.0 zostáva otvorená.
Zdroj: 3dnews.ru
