A mystery computer virus discovered last month and deployed in a massive cyberattack chiefly against Iran sought to steal designs and PDF files from its victims, a Russian firm said.
Kaspersky Lab, one of the world’s biggest producers of anti-virus software, announced last month the discovery of the Flame virus, which it described as the biggest and most sophisticated malware ever seen.
In the latest update on Kaspersky’s analysis of the virus, released late on Monday, the firm’s chief security expert, Alexander Gostev, said the malware’s creators had focussed on file formats such as PDF and AutoCAD, a software for computer design and drawing.
“The attackers seem to have a high interest in AutoCAD drawings,” Gostev said in a statement.
The malware also “goes through PDF and text files and other documents and makes short text summaries,” he added.
“It also hunts for e-mails and many different kinds of other ‘interesting’ [high-value] files that are specified in the malware configuration,” he said.
He confirmed that Iran was by far the biggest target with a count of 185 infections, followed by 95 in Israel and the Palestinian Territories, 32 in Sudan and 29 in Syria.
The discovery of Flame immediately sparked speculation that it had been created by US and Israeli security services to steal information about Iran’s controversial nuclear drive.
Intriguingly, Kaspersky said that hours after the existence of the virus was first announced on May 28, “The Flame command-and-control infrastructure, which had been operating for years, went dark.”
It gave no further information over the possible perpetrators of the mystery attack, though it identified about 80 domains that appear to belong to the Flame infrastructure, in locations from Hong Kong to Switzerland.
Kaspersky said it had used a procedure known as sinkholing — which allows Internet security experts to gain control of a malicious server — to analyze the operation.
During the sinkholing it found that on three computers in Lebanon, Iraq and Iran the Flame versions changed, suggesting Flame upgraded itself in the process.
Meanwhile, Microsoft Corp has warned that a bug in Windows allowed PCs across the Middle East to become infected with the Flame virus and released a software fix to fight it.
A spokeswoman for Microsoft declined to comment on whether other viruses had exploited the same flaw in Windows or if the company’s security team was looking for similar bugs in the operating system.
Flame’s code included what is known as a digital certificate, which falsely identified it as a piece of software from Microsoft.
A bug in Terminal Services licensing allowed the hackers to use it to create fake certificates that identified Flame as being from Microsoft, Mike Reavey, a senior director with Microsoft’s Security Response Center, said in a blog post.
“We continue to investigate this issue and will take any appropriate actions to help protect customers,” Reavey said in the blog post.
The Chinese People’s Liberation Army (PLA) is constructing a new counter-stealth radar system on a disputed reef in the South China Sea that would significantly expand its surveillance capabilities in the region, satellite imagery suggests. Analysis by London-based think tank Chatham House suggests China is upgrading its outpost on Triton Island (Jhongjian Island, 中建島) on the southwest corner of the Paracel Islands (Xisha Islands, 西沙群島), building what might be a launching point for an anti-ship missile battery and sophisticated radar system. “By constraining the US ability to operate stealth aircraft, and threaten stealth aircraft, these capabilities in the South China Sea send
HAVANA: Repeated blackouts have left residents of the Cuban capital concerned about food, water supply and the nation’s future, but so far, there have been few protests Maria Elena Cardenas, 76, lives in a municipal shelter on Amargura Street in Havana’s colonial old town. The building has an elegant past, but for the last few days Maria has been cooking with sticks she had found on the street. “You know, we Cubans manage the best we can,” she said. She lives in the shelter because her home collapsed, a regular occurrence in the poorest, oldest parts of the beautiful city. Cuba’s government has spent the last days attempting to get the island’s national grid functioning after repeated island-wide blackouts. Without power, sleep becomes difficult in the heat, food
Botswana is this week holding a presidential election energized by a campaign by one previous head-of-state to unseat his handpicked successor whose first term has seen rising discontent amid a downturn in the diamond-dependent economy. The charismatic Ian Khama dramatically returned from self-exile six weeks ago determined to undo what he has called a “mistake” in handing over in 2018 to Botswanan President Mokgweetsi Masisi, who seeks re-election tomorrow. While he cannot run as president again having served two terms, Khama has worked his influence and standing to support the opposition in the southern African country of 2.6 million people. “The return of
Ukrainian President Volodymyr Zelenskiy has rejected a plan for the UN Secretary-General Antonio Guterres to visit Kyiv due to Guterres’ attendance at this week’s BRICS summit in Russia, a Ukrainian official said on Friday. Kyiv was enraged by Guterres’ appearance at the event in the city of Kazan on Thursday and his handshake with its host, Russian President Vladimir Putin, whose forces invaded Ukraine on Feb. 24, 2022. Guterres, who called for a “just peace” in Ukraine at the BRICS event and has repeatedly condemned the invasion, discussed a visit to Ukraine with Zelenskiy when they met in New York