Loading malware…
Flame, also known as Flamer and sKyWIper, is a highly sophisticated modular cyber-espionage platform for Windows that came to public attention in 2012 after investigations into destructive incidents in the Middle East. It is widely regarded as a state-linked espionage malware framework and has been associated in public reporting with the broader ecosystem behind Stuxnet, Duqu, Gauss, and miniFlame. Flame was used in targeted intrusions, particularly in the Middle East, and has been linked to long-running intelligence collection operations rather than commodity cybercrime.
Flame is notable for its large size, extensive modularity, and breadth of collection capabilities. Reported functions include theft of documents and metadata, screenshots triggered by specific applications or windows, collection from keyboards and microphones, harvesting of images and technical files, and gathering of network, system, Wi-Fi, Bluetooth, USB, and process information. Collected data was stored in structured local databases and exfiltrated to command-and-control infrastructure. The malware also performed security software discovery to identify defensive products on infected systems.
Operationally, Flame used multiple stealth and persistence mechanisms. Public analyses describe execution via rundll32 and persistence through Windows LSA authentication package abuse, along with stealthy code injection into core Windows processes. The platform used custom encryption, compression, and proprietary storage formats, and relied heavily on modular components and scripting. Its design and operational maturity indicate substantial development resources and long-term maintenance.
Flame also demonstrated advanced propagation tradecraft. Reported spread mechanisms include local shares, USB-based propagation, abuse of the Windows Print Spooler vulnerability CVE-2010-2729, and use of the Windows shortcut vulnerability CVE-2010-2568 in air-gapped or removable-media scenarios. It is especially notable for abusing a forged Microsoft code-signing certificate through an MD5 collision attack to impersonate Windows Update and deliver malicious updates, one of the most prominent examples of malicious use of trusted software update channels.
Flame primarily targeted Windows environments and has been described as one of the most capable espionage malware platforms publicly documented from its era. Its discovery helped expose a broader cluster of advanced state-sponsored tooling focused on covert intelligence collection, selective propagation, and long-duration access to strategically significant targets.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Stuxnet was well known for its use of CVE-2010-2729, the Windows Print Spooler RCE exploit. Flame used it as well. | Flame arguably had the most extensive information-stealing capabilities, being able to steal whole documents or metadata, images and GPS coordinates, technical CAD drawings and more.
The most famous vulnerability is without a doubt CVE-2010-2568, aka the “Stuxnet LNK exploit”. ... Fanny had used that exploit even before Stuxnet ... Flame, Gauss and miniFlame continued to use it afterwards. | Flame arguably had the most extensive information-stealing capabilities, being able to steal whole documents or metadata, images and GPS coordinates, technical CAD drawings and more.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Flame (a.k.a Flamer or sKyWIper) was the object of extensive research and fascination by the security community circa 2011.
Three years ago, on May 28th 2012, we announced the discovery of a malware known as Flame. At the same time we published our FAQ, CrySyS Lab posted their thorough analysis of sKyWIper. A few days earlier, Maher CERT published IOCs for Flamer. In short, Flame, sKyWIper and Flamer are different names for the same threat.
38 distinct techniques documented for this family, organized by ATT&CK tactic.
var s = GetObject("winmgmts:root\\cimv2");var oProcs = s.ExecQuery("SELECT * FROM Win32_Process ..."); s.Delete("__EventFilter.Name='FilterForClassCreation'");
var objFileSystem = new ActiveXObject("Scripting.FileSystemObject");var s = GetObject("winmgmts:root\\cimv2");
Malicious LNK files are usually used as the exploit to trigger a vulnerability in old components of Windows, such as the Windows Shell, that allow the malware to get remote code execution with no user action required other than viewing the LNK file in Windows Explorer.
Frog Infect machines using pre-defined user accounts. The only user account specified in the configuration resource is “HelpAssistant” that is created by the “Limbo” attack.
Limbo Creates backdoor accounts with login “HelpAssistant” on the machines within the network domain if appropriate rights are available.
The malware can be started using two different methods: 1. Set msgsecmgr.ocx in the registry ... At startup, mssecmgr.ocx is loaded as LSA Authentication Package.
There are multiple injections of code during startup... the code injection mechanism is stealthier such that the presence of the code injection cannot be determined by conventional methods... these regions must have been allocated dynamically by means of VirtualAllocEx() or WriteProcessMemory().
Frog Infect machines using pre-defined user accounts. The only user account specified in the configuration resource is “HelpAssistant” that is created by the “Limbo” attack.
The malware can be started using two different methods: 1. Set msgsecmgr.ocx in the registry ... At startup, mssecmgr.ocx is loaded as LSA Authentication Package.
There are multiple injections of code during startup... the code injection mechanism is stealthier such that the presence of the code injection cannot be determined by conventional methods... these regions must have been allocated dynamically by means of VirtualAllocEx() or WriteProcessMemory().
Self-kill logic inside ... SUICIDE.RESIDUAL_FILES ... %temp%\~a28.tmp ... %windir%\system32\commgr32.dll
Frog Infect machines using pre-defined user accounts. The only user account specified in the configuration resource is “HelpAssistant” that is created by the “Limbo” attack.
Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations.
Snack Listens on network interfaces, receives and saves NBNS packets in a log file.
Beetlejuice Bluetooth: enumerates devices around the infected machine. May turn itself into a “beacon”
Snack Listens on network interfaces, receives and saves NBNS packets in a log file.
Beetlejuice Bluetooth: enumerates devices around the infected machine... Snack Listens on network interfaces, receives and saves NBNS packets in a log file.
Frameworks gather information such as computer name, username, domain name, list of running processes
Frameworks gather information such as computer name, username, domain name, list of running processes, listing of files in directories, drives and network shares, as well as network configuration information
They check for the existence of specific files, windows registry entries, and other signs ... For example, this script looks for the existence of an actual file “winver32.exe” in the very specific $docsandsettings\\$subkey\\Application Data\\winver32.exe path.
All the frameworks used USB drives as the physical transmission medium to transfer data in and out of the targeted air-gapped networks.
USBStealer, USBCulprit, Retro, USBThief, PlugX and Ramsay, for example, were clearly built to steal specific files.
It covers all major possibilities to gather intelligence, including keyboard, screen, microphone, storage devices, network, wifi, Bluetooth, USB and system processes.
The routine downloads the file mssecmgr.ocx ... Further information shows that this is related to the windows update mechanism and the MUNCH attack
33 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
67 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a highly sophisticated espionage malware example from the era of detailed public technical teardowns.
Referenced as a sophisticated malware framework known for embedding a Lua scripting engine to provide modularity.
A sophisticated malware platform discovered in 2012 that incorporated a Lua virtual machine.
A known nation-state espionage malware/toolkit referenced for comparison with fast16.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.