Kaspersky Lab Uncovers MiniFlame Virus

"Flame was a sword, miniFlame is a scalpel"

Kaspersky Lab has unearthed a computer virus that is related to Flame and can carry out precise cyber-attacks on targets in the Middle East.

The so-called miniFlame virus has only infected around 50 "high-value" machines, according to Kaspersky Lab, much less than the 5,000 computers in Iran and Sudan that Flame is believed to have infected, but its attacks can be more precise.

MiniFlame infections were found mostly in Lebanon and Iran, but also in the Palestinian Territories, Iran, Kuwait and Qatar.

"MiniFlame is installed in order to conduct more in-depth surveillance and cyber-espionage," Kaspersky Chief Security Expert Alexander Gostev told Reuters.

Iran has previously blamed the Flame virus for causing data loss on computers in the country's main oil terminal and Oil Ministry.

Kaspersky Lab senior researcher Roel Schouwenberg told Reuters on 15 October: "Flame acts as a long sword for broad swipes while miniFlame acts as a scalpel for a focused surgical dissection."

Flame was found to be loosely related to early versions of the infamous Stuxnet virus in 2010. Widely believed to be an American project, and described as the first true cyber-weapon, Stuxnet was aimed at Iran's nuclear enrichment programme.

Kaspersky Lab believes that miniFlame was distributed mainly by Flame and Gauss, another recently discovered computer virus which was most widely seen in Lebanon and may have been used to track financial transactions - it is not yet known what purpose miniFlame has.

The company said that it has found six versions of miniFlame and the most recent was created in September 2011, while some of the protocols it uses date back to 2007, suggesting that it has been active for some years.

Reuters said: "MiniFlame responded to a series of commands given Anglo first names by the program authors. 'Elvis' created a process on an infected machine and 'Barbara' took a screenshot. 'Tiffany' directed the computer to a new command server."