Flame
Flame, also known as Flamer and sKyWIper/Skywiper, is a highly advanced, large, modular Windows cyber-espionage malware platform publicly disclosed in May 2012 by Kaspersky Lab, CrySyS Lab, and Iran’s MAHER CERT. It was used in targeted attacks and broad intelligence collection, primarily affecting the Middle East, with reported infections in Iran, Israel/Palestine, Sudan, Syria, Lebanon, Saudi Arabia, and Egypt; other reporting and telemetry also referenced infections or artifacts in the UAE, Europe, and Hungary. Multiple sources in the content state it likely operated undetected for years, with estimates ranging from about five years to five-to-eight years.
Its capabilities include stealing documents and other files, keylogging, screenshot capture, copying instant messaging chats, recording audio via attached microphones, collecting Bluetooth phone contact data, gathering network architecture information and passwords, scanning disks for specific file types and contents, sniffing network traffic, detecting network resources, collecting vulnerable passwords, and exfiltrating data to command-and-control infrastructure. The malware is modular and can receive and install additional modules for different goals, including attack execution, propagation, network scanning, file leakage, and self-removal. CrySyS reported intelligence collection from keyboards, screens, microphones, storage devices, networks, Wi-Fi, Bluetooth, USB devices, and system processes.
Flame used multiple propagation and persistence mechanisms. Reported vectors include removable media/USB, local networks and shares, Windows Update-themed mechanisms, and use of Stuxnet-related exploits MS10-061 and MS10-046. A notable capability described in the content is Flame’s use of forged Microsoft certificates enabled by a chosen-prefix MD5 collision attack, allowing it to impersonate Microsoft software and hijack Windows Update on local networks. It also supported exfiltration from air-gapped environments by storing stolen data on infected USB drives in a hidden folder named "." and later sending it to C2 when connected to an Internet-connected system. Persistence and startup mechanisms included abuse of the LSA Authentication Packages registry key to load mssecmgr.ocx, as well as rundll32.exe loading mssecmgr.ocx via the DDEnumCallback export.
Technical characteristics directly mentioned include an unusually large size of roughly 20 MB when fully deployed; use of at least five encryption methods and multiple compression techniques; use of SQLite databases for structured storage of collected data; and extensive use of Lua. CrySyS and MAHER identified components including mssecmgr.ocx, advnetcfg.ocx, nteps32.ocx, msglu32.ocx, soapr32.ocx, ccalc32.sys, boot32drv.sys, and wavesup3.drv. CrySyS also reported stealthy code injection into winlogon.exe, services.exe, and explorer.exe; explorer.exe hooking shell32.dll’s SHGetSpecialFolderPathW; registry values wave8 and wave9 under Drivers32; mutexes tied to wpgfilter.dat and audcache; and a user agent string of "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.2150)." MAHER reported C2 communications over SSH and HTTPS using more than 10 domains, while CrySyS described an internal C2 framework called GATOR and noted more than 50 domains and more than 15 IPs with frequent changes.
The malware infected Windows XP, Vista, and 7 systems. It was widely characterized in the content as one of the most sophisticated malware platforms known at the time, more complex than Stuxnet, and strongly suggestive of nation-state development. Several cited reports and articles associate Flame with the same broader ecosystem as Stuxnet and Duqu; some content states Western officials said the United States and Israel jointly developed Flame for intelligence collection related to cyber-sabotage against Iran’s nuclear program, while other technical reporting says links to Stuxnet/Duqu existed but were not conclusively proven at the time. High-confidence reporting in the content consistently places Flame in the context of targeted espionage against Iranian and broader Middle Eastern networks.
The content also notes self-removal behavior: in June 2012, operators reportedly pushed a kill/SUICIDE module that deleted Flame and related files and overwrote file locations with random data to hinder forensic analysis. Known indicators and artifacts directly mentioned in the content include the LSA Authentication Packages registry reference to mssecmgr.ocx; files mssecmgr.ocx, advnetcfg.ocx, nteps32.ocx, msglu32.ocx, soapr32.ocx, ccalc32.sys, boot32drv.sys, wavesup3.drv, wpgfilter.dat, and ~DEB93D.tmp; and the malware aliases Flame, Flamer, sKyWIper, and Skywiper.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Three years ago, on May 28th 2012, we announced the discovery of a malware known as Flame. At the same time we published our FAQ, CrySyS Lab posted their thorough analysis of sKyWIper. A few days earlier, Maher CERT published IOCs for Flamer. In short, Flame, sKyWIper and Flamer are different names for the same threat.
Flame (a.k.a Flamer or sKyWIper) was the object of extensive research and fascination by the security community circa 2011.
Techniques & procedures
39 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniquesFrog Infect machines using pre-defined user accounts. The only user account specified in the configuration resource is “HelpAssistant” that is created by the “Limbo” attack.
Execution
4 techniquesvar s = GetObject("winmgmts:root\\cimv2");var oProcs = s.ExecQuery("SELECT * FROM Win32_Process ..."); s.Delete("__EventFilter.Name='FilterForClassCreation'");
var objFileSystem = new ActiveXObject("Scripting.FileSystemObject");var s = GetObject("winmgmts:root\\cimv2");
We also have clear indications that Stuxnet’s print spooler exploit (MS10-061) and lnk exploit (MS10-046) is used within sKyWIper as well
Persistence
5 techniquesFrog Infect machines using pre-defined user accounts. The only user account specified in the configuration resource is “HelpAssistant” that is created by the “Limbo” attack.
Limbo Creates backdoor accounts with login “HelpAssistant” on the machines within the network domain if appropriate rights are available.
The malware can be started using two different methods: 1. Set msgsecmgr.ocx in the registry ... At startup, mssecmgr.ocx is loaded as LSA Authentication Package.
For installations and startup, LSA is abused: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Autenthication Packages will contain in new line mssecmgr.ocx
Privilege Escalation
6 techniquesThere are multiple injections of code during startup... the code injection mechanism is stealthier such that the presence of the code injection cannot be determined by conventional methods... these regions must have been allocated dynamically by means of VirtualAllocEx() or WriteProcessMemory().
The 2009 Stuxnet was built to replicate using an exploit from Flame. This indicates the two were indeed connected.
Frog Infect machines using pre-defined user accounts. The only user account specified in the configuration resource is “HelpAssistant” that is created by the “Limbo” attack.
The malware can be started using two different methods: 1. Set msgsecmgr.ocx in the registry ... At startup, mssecmgr.ocx is loaded as LSA Authentication Package.
For installations and startup, LSA is abused: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Autenthication Packages will contain in new line mssecmgr.ocx
Stealth
5 techniquesThere are multiple injections of code during startup... the code injection mechanism is stealthier such that the presence of the code injection cannot be determined by conventional methods... these regions must have been allocated dynamically by means of VirtualAllocEx() or WriteProcessMemory().
Self-kill logic inside ... SUICIDE.RESIDUAL_FILES ... %temp%\~a28.tmp ... %windir%\system32\commgr32.dll
Frog Infect machines using pre-defined user accounts. The only user account specified in the configuration resource is “HelpAssistant” that is created by the “Limbo” attack.
Run the malware from rundll32 using the command as follows: start /wait rundll32.exe c:\windows\system32\mssecmgr.ocx,DDEnumCallback
Defense Impairment
2 techniquesThe attack involved the almost magical re-engineering of a certificate that could be used to sign Windows updates. The certificate relied on an MD5 signature, which the attackers managed to fake.
2005, two x.509 certificates sharing the same hash with different public keys are published... 2012, the Flame malware uses a forged Microsoft code-signing certificate with MD5 collision against a valid one.
Credential Access
4 techniquesSnack Listens on network interfaces, receives and saves NBNS packets in a log file.
It covers all major possibilities to gather intelligence, including keyboard, screen, microphone, storage devices, network, wifi, Bluetooth, USB and system processes.
CRUISE_CRED.lua The script gathers credential information from an already infected machine. More precisely, it cruises all the token objects to find the ones belong to the administrator or the Administrators, Domain Admins groups.
2012, the Flame malware uses a forged Microsoft code-signing certificate with MD5 collision against a valid one.
Discovery
8 techniquesThe massive piece of malware secretly mapped and monitored Iran's computer networks, sending back a steady stream of intelligence to prepare for a cyberwarfare campaign.
Beetlejuice Bluetooth: enumerates devices around the infected machine. May turn itself into a “beacon”
Snack Listens on network interfaces, receives and saves NBNS packets in a log file.
Beetlejuice Bluetooth: enumerates devices around the infected machine... Snack Listens on network interfaces, receives and saves NBNS packets in a log file.
Compressed parts contain info on running processes... ~HLV473.tmp – information on running processes inside (Far.exe)
lmcache.dat Information on target computer. ntcache.dat Information on target computer... basic_info_app.lua gathers basic information about an infected computer such as the flame version ... the computer name, the ip address of the machine.
Weasel Creates a directory listing of the infected computer... The malware saves ~rf<number> files in /windows/temp... storing information on drivers, directories, and file names.
Security Identifies programs that may be hazardous to Flame, i.e., anti-virus programs and firewalls.
Lateral Movement
3 techniquesTransport: Replication method... that based on bad access permissions is a “Transport”. E.g. “NU” or “NUSystem” refers to “net use” way of propagation. obj.REMOTE_PATH_TEMPLATES = {temp = string.format("\\\\%s\\admin$\\temp", l_4_0.tgt)
Infectmedia Selects one of the methods for infecting media, i.e. USB disks. Available methods: Autorun_infector, Euphoria.
We also have clear indications that Stuxnet’s print spooler exploit (MS10-061) and lnk exploit (MS10-046) is used within sKyWIper as well
Collection
4 techniquesThe malware was designed to automatically collect everything from infected machines, ranging from documents to screenshots, keystrokes and audio.
It covers all major possibilities to gather intelligence, including keyboard, screen, microphone, storage devices, network, wifi, Bluetooth, USB and system processes.
advnetcfg.ocx (0.6 M) Injected part, possibly info stealer (screen shots and alike)
Microbe Records audio from existing hardware sources. Lists all multimedia devices, stores complete device configuration, tries to select suitable recording device.
Command and Control
5 techniquesMunch: Installation/propagation mechanism related to windows update and web downloads... HTTP server that responds to “/view.php” and “/wpad.dat” requests.
The routine downloads the file mssecmgr.ocx ... Further information shows that this is related to the windows update mechanism and the MUNCH attack
“Those controlling the virus can direct it from a distance,” Mr. Napelian said. “Flame is no ordinary product. This was designed to monitor selected computers.”
C&C servers are changed frequently by changing the IP address of the particular host/domain name (the well-known fluxing technique used by botnets).
connect(10.55.55.55,80,6); ... One method we are aware of is related to windows update and file downloading by some modules using SSL and some proprietary text based protocol.
Exfiltration
1 techniqueWhen such a stick was connected to a machine infected by Flame connected to the Internet, the hidden information was taken off the stick and sent to its C&Cs.
Other
1 techniqueIOCs tracked for this family
29 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
53 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a highly sophisticated espionage malware example from the era of detailed public technical teardowns.
Referenced as a sophisticated malware framework known for embedding a Lua scripting engine to provide modularity.
A sophisticated malware platform discovered in 2012 that incorporated a Lua virtual machine.
A known nation-state espionage malware/toolkit referenced for comparison with fast16.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.