Flame ( malware ) Flame , also known as Flamer , sKyWIper , and Skywiper , is modular computer malware discovered in 2012 that attacks computers running the Microsoft Windows operating system . The program is being used for targeted cyber espionage in Middle Eastern countries . Its discovery was announced on 28 May 2012 by MAHER Center of Iranian National Computer Emergency Response Team ( CERT ) , Kaspersky Lab and CrySyS Lab of the Budapest University of Technology and Economics . The last of these stated in its report that it " is certainly the most sophisticated malware we encountered during our practice ; arguably , it is the most complex malware ever found . " Flame can spread to other systems over a local network ( LAN ) or via USB stick . It can record audio , screenshot s , keyboard activity and network traffic . The program also records Skype conversations and can turn infected computers into Bluetooth beacons which attempt to download contact information from nearby Bluetooth - enabled devices . This data , along with locally stored documents , is sent on to one of several command and control servers that are scattered around the world . The program then awaits further instructions from these servers . According to estimates by Kaspersky in May 2012 , Flame had initially infected approximately 1 , 000 machines , with victims including governmental organizations , educational institutions and private individuals . At that time 65 % of the infections happened in Iran , Israel , Palestine , Sudan , Syria , Lebanon , Saudi Arabia , and Egypt , with a " huge majority of targets " within Iran . Flame has also been reported in Europe and North America . Flame supports a " kill " command which wipes all traces of the malware from the computer . The initial infections of Flame stopped operating after its public exposure , and the " kill " command was sent . History . Flame ( a . k . a Da Flame ) was identified in May 2012 by MAHER Center of Iranian National CERT , Kaspersky Lab and CrySyS Lab ( Laboratory of Cryptography and System Security ) of the Budapest University of Technology and Economics when Kaspersky Lab was asked by the United Nations International Telecommunication Union to investigate reports of a virus affecting Iranian Oil Ministry computers . As Kaspersky Lab investigated , they discovered an MD5 hash and filename that appeared only on customer machines from Middle Eastern nations . After discovering more pieces , researchers dubbed the program " Flame " after the name of one of its modules . According to Kaspersky , Flame had been operating in the wild since at least February 2010 . CrySyS Lab reported that the file name of the main component was observed as early as December 2007 . However , its creation date could not be determined directly , as the creation dates for the malware ' s modules are falsely set to dates as early as 1994 . Computer experts consider it the cause of an attack in April 2012 that caused Iranian officials to disconnect their oil terminals from the Internet . At the time the Iranian Students News Agency referred to the malware that caused the attack as " Wiper " , a name given to it by the malware ' s creator . However , Kaspersky Lab believes that Flame may be " a separate infection entirely " from the Wiper malware . Due to the size and complexity of the program — described as " twenty times " more complicated than Stuxnet — the Lab stated that a full analysis could require as long as ten years . On 28 May , Iran ' s CERT announced that it had developed a detection program and a removal tool for Flame , and had been distributing these to " select organizations " for several weeks . After Flame ' s exposure in news media , Symantec reported on 8 June that some Flame command and control ( C & C ) computers had sent a " suicide " command to infected PCs to remove all traces of Flame . According to estimates by Kaspersky in May 2012 , initially Flame had infected approximately 1 , 000 machines , with victims including governmental organizations , educational institutions and private individuals . At that time the countries most affected were Iran , Israel , Palestine , Sudan , Syria , Lebanon , Saudi Arabia , and Egypt . Operation . Flame is an uncharacteristically large program for malware at 20 megabyte s . It is written partly in the Lua scripting language with compiled C + + code linked in , and allows other attack modules to be loaded after initial infection . The malware uses five different encryption methods and a SQLite database to store structured information . The method used to inject code into various processes is stealthy , in that the malware modules do not appear in a listing of the modules loaded into a process and malware memory pages are protected with READ , WRITE and EXECUTE permissions that make them inaccessible by user - mode applications . The internal code has few similarities with other malware , but exploits two of the same security vulnerabilities used previously by Stuxnet to infect systems . The malware determines what antivirus software is installed , then customises its own behaviour ( for example , by changing the filename extension s it uses ) to reduce the probability of detection by that software . Additional indicators of compromise include mutex and registry activity , such as installation of a fake audio driver which the malware uses to maintain persistence on the compromised system . Flame is not designed to deactivate automatically , but supports a " kill " function that makes it eliminate all traces of its files and operation from a system on receipt of a module from its controllers . Flame was signed with a fraudulent certificate purportedly from the Microsoft Enforced Licensing Intermediate PCA certificate authority . The malware authors identified a Microsoft Terminal Server Licensing Service certificate that inadvertently was enabled for code signing and that still used the weak MD5 hashing algorithm , then produced a counterfeit copy of the certificate that they used to sign some components of the malware to make them appear to have originated from Microsoft . A successful collision attack against a certificate was previously demonstrated in 2008 , but Flame implemented a new variation of the chosen - prefix collision attack . Deployment . Like the previously known cyber weapons Stuxnet and Duqu , it is employed in a targeted manner and can evade current security software through rootkit functionality . Once a system is infected , Flame can spread to other systems over a local network or via USB stick . It can record audio , screenshots , keyboard activity and network traffic . The program also records Skype conversations and can turn infected computers into Bluetooth beacons which attempt to download contact information from nearby Bluetooth enabled devices . This data , along with locally stored documents , is sent on to one of several command and control servers that are scattered around the world . The program then awaits further instructions from these servers . Unlike Stuxnet , which was designed to sabotage an industrial process , Flame appears to have been written purely for espionage . It does not appear to target a particular industry , but rather is " a complete attack toolkit designed for general cyber - espionage purposes " . Using a technique known as sinkholing , Kaspersky demonstrated that " a huge majority of targets " were within Iran , with the attackers particularly seeking AutoCAD drawings , PDFs , and text file s . Computing experts said that the program appeared to be gathering technical diagrams for intelligence purposes . A network of 80 servers across Asia , Europe and North America has been used to access the infected machines remotely . Origin . On 19 June 2012 , " The Washington Post " published an article claiming that Flame was jointly developed by the U . S . National Security Agency , CIA and Israel ’ s military at least five years prior . The project was said to be part of a classified effort code - named Olympic Games , which was intended to collect intelligence in preparation for a cyber - sabotage campaign aimed at slowing Iranian nuclear efforts . According to Kaspersky ' s chief malware expert , " the geography of the targets and also the complexity of the threat leaves no doubt about it being a nation - state that sponsored the research that went into it . " Kaspersky initially said that the malware bears no resemblance to Stuxnet , although it may have been a parallel project commissioned by the same attackers . After analysing the code further , Kaspersky later said that there is a strong relationship between Flame and Stuxnet ; the early version of Stuxnet contained code to propagate via USB drives that is nearly identical to a Flame module that exploits the same zero - day vulnerability . Iran ' s CERT described the malware ' s encryption as having " a special pattern which you only see coming from Israel " . " The Daily Telegraph " reported that due to Flame ' s apparent targets — which included Iran , Syria , and the West Bank — Israel became " many commentators ' prime suspect " . Other commentators named China and the U . S . as possible perpetrators . Richard Silverstein , a commentator critical of Israeli policies , stated that he had confirmed with a " senior Israeli source " that the malware was created by Israeli computer experts . " The Jerusalem Post " wrote that Israel ' s Vice Prime Minister Moshe Ya ' alon appeared to have hinted that his government was responsible , but an Israeli spokesperson later denied that this had been implied . Unnamed Israeli security officials suggested that the infected machines found in Israel may imply that the virus could be traced to the U . S . or other Western nations . The U . S . has officially denied responsibility .