Flame I'm Gonna Live Forever

Meet MiniFlame, The Ninja Assassin of Cyber Warfare Tools

MiniFlame targets a small number of users.
kasperskyminiflamedistrib Meet MiniFlame, The Ninja Assassin of Cyber Warfare Tools

Countries where MiniFlame and Flame have been found. (Kaspersky Lab)

Researchers at Kaspersky Lab have been patiently picking apart the ingenious malware packages that romped through computer networks in the Middle East, sucking up data and destroying Iranian nuclear centrifuges and it seems Kaspersky finds a new addition to the allegedly U.S. and Israeli-sponsored family of cyber-weapons every other month. Monday they announced the discovery of the Flame malware’s baby cousin, MiniFlame.

Kaspersky’s bug hunters found that MiniFlame’s association with Flame and related infections was Transformers-like in nature:

In early July 2012, we discovered a smaller Flame module, which appeared to be able to work by itself. The module had many similarities with Flame, so we thought it might simply be an earlier version. In the months that followed, we not only studied the connection of this malware with Flame, but also came across examples of this module being used concurrently with Gauss and being controlled by the Gauss main module.

Researchers found that MiniFlame was something of a ninja assassin compared to the other programs. Whereas Flame, Duqu and Gauss had large missions to infiltrate multiple computers in countries like Iran, Syria and Lebanon, MiniFlame targeted just a few select victims in what Kaspersky calls “highly targeted attacks.” Kaspersky reported that MiniFlame, while rare compared to the more well-known malware packages, was more likely to show up in a variety of countries, including a computer located at the Francois Rabelais University in Tours, France.

Wired also noted that Kaspersky determined that one machine in Lebanon is the lucky recipient of every nasty cyber weapon in the family:

[There] is one machine in Lebanon – what [senior Kaspersky researcher Roel] Schouwenberg calls “the mother of all infections” – which has Flame, Gauss, and miniFlame/SPE on it. “It is like everybody wanted to infect that specific victim in Lebanon for some reason,” he says.

Kaspersky knows there are two more malware packages still in the wild, currently code-named only SP and IP. They may function much like the previously known malicious programs, churning through the guts of target computers for sensitive data to send home to their controllers before they execute the final trick in their arsenal, deleting themselves and vanishing from the infected system as if they’d never been there at all, like ghosts. Or ninjas.

Follow Steve Huff via RSS. shuff@observer.com