Flame

MITRE ATT&CK: S0143 View on attack.mitre.org

Aliases: Flamer, sKyWIper, Flame

First seen
2010-01-01 00:00:00
Malware type
spyware, worm
Family
Malware family
Operating systems
windows
Related IoCs
1 (1 malicious)
Last IoC activity
2026-06-05 05:57:20
Profile updated
2026-07-07 12:48:34

Targeted industries: government-and-public-sector energy-and-utilities

Targeted regions: country_code:ir country_code:il country_code:sa country_code:sy

Context

Flame is a sophisticated toolkit that has been used to collect information since at least 2010, largely targeting Middle East countries.

Recent IoC activity

1 malicious indicator in Maltiverse are attributed to Flame (S0143). The 1 most recently updated:

TypeIndicatorUpdatedSources
file sample 00004784.dl 2026-06-05 1

Detection coverage

  • 1 YARA rules
  • 72 Sigma rules

Malware & tools used

  • Exploitation of Remote Services (attack-pattern)
  • Audio Capture (attack-pattern)
  • Exfiltration Over Bluetooth (attack-pattern)
  • Masquerade Account Name (attack-pattern)
  • Security Software Discovery (attack-pattern)
  • Local Account (attack-pattern)
  • Screen Capture (attack-pattern)
  • Authentication Package (attack-pattern)
  • Rundll32 (attack-pattern)
  • Data from Local System (attack-pattern)
  • Theft of Operational Information (attack-pattern)
  • Replication Through Removable Media (attack-pattern)

Detection rules

  • MALPEDIA_Win_Flame_Auto (yara-rule)

Reports & references

  • Broadcom/Symantec — Viewdocument (report)
  • crysys.hu — Ukatemicrysys Territorialdispute (report)
  • ESET — Eset Jumping The Air Gap Wp (report)
  • web.archive.org — 202304114E0Fa0F4Fd1D408Aaddeef8Be63A4757 20230411161526 0531 (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Flame (report)
  • github.com — Flame%202.0%20Risen%20From%20The%20Ashes (report)
  • storage.googleapis.com — Flame%202.0%20Risen%20From%20The%20Ashes (report)
  • Broadcom/Symantec — Flamer Recipe Bluetoothache (report)
  • Kaspersky — 34344 (report)
  • crysys.hu — Skywiper (report)
  • MITRE ATT&CK — S0143 (report)

External references