Symantec’s Security Response team is analysing a new highly
sophisticated and discreet threat: W32.Flamer, which it says is on par
with the other cyberspace threats like Stuxnet and Duqu.
In a statement, Symantec said the analysis so far revealed that the malware has been built with the ability to obtain information from infected systems primarily located in the Middle East.
As with the previous two threats, this code was not written by a single individual but by an organised well funded group of personnel with directives, it said.
The code includes multiple references to the string ‘FLAME’ which may be indicative of either instances of attacks by various parts of the code, or the malware’s development project name, it said.
The threat has operated discreetly for at least two years with the ability to steal documents, take screenshots of users’ desktops, spread via Universal Serial Bus (USB) drives, disable security vendor products, and under certain conditions spread to other systems, it added.
The threat may also have the ability to leverage multiple known and patched vulnerabilities in Microsoft Windows, in order to spread across a network.
Initial telemetry indicates that the targets of this threat are located primarily in Palestinian West Bank, Hungary, Iran, and Lebanon while other targets include Russia, Austria, Hong Kong, and the United Arab Emirates. The industry sectors or affiliations of individuals targeted are currently unclear, said Symantec.
However, initial evidence shows the victims may not all be targeted for the same reason, it added. Many appear targeted for individual personal activities, rather than their company of employment, it said.
Interestingly, in addition to particular organisations being targeted, many of the attacked systems appear to be personal computers being used from home Internet connections, it said.
The recent Symantec’s Internet Security Threat Report 17 saw the number of targeted attacks increase dramatically during 2011 from an average of 77 per day in 2010 to 82 per day in 2011.--BERNAMA MSL SD
SOURCE: http://www.thesundaily.my/news/391758
In a statement, Symantec said the analysis so far revealed that the malware has been built with the ability to obtain information from infected systems primarily located in the Middle East.
As with the previous two threats, this code was not written by a single individual but by an organised well funded group of personnel with directives, it said.
The code includes multiple references to the string ‘FLAME’ which may be indicative of either instances of attacks by various parts of the code, or the malware’s development project name, it said.
The threat has operated discreetly for at least two years with the ability to steal documents, take screenshots of users’ desktops, spread via Universal Serial Bus (USB) drives, disable security vendor products, and under certain conditions spread to other systems, it added.
The threat may also have the ability to leverage multiple known and patched vulnerabilities in Microsoft Windows, in order to spread across a network.
Initial telemetry indicates that the targets of this threat are located primarily in Palestinian West Bank, Hungary, Iran, and Lebanon while other targets include Russia, Austria, Hong Kong, and the United Arab Emirates. The industry sectors or affiliations of individuals targeted are currently unclear, said Symantec.
However, initial evidence shows the victims may not all be targeted for the same reason, it added. Many appear targeted for individual personal activities, rather than their company of employment, it said.
Interestingly, in addition to particular organisations being targeted, many of the attacked systems appear to be personal computers being used from home Internet connections, it said.
The recent Symantec’s Internet Security Threat Report 17 saw the number of targeted attacks increase dramatically during 2011 from an average of 77 per day in 2010 to 82 per day in 2011.--BERNAMA MSL SD
SOURCE: http://www.thesundaily.my/news/391758
