Researchers found similarities between Regin and Flame, which the episode describes as a spy tool.
Explicit Confidence 96% · Jack Rhysider EP 48 Details
“Analysis of Regin revealed some similar features to other malware like Flame and Duqu.”
Malware
malware:flame
Spy malware discussed as having features similar to Regin.
Spy malware discussed as having features similar to Regin.
“Flame was a spy tool used to collect data to target individuals and businesses”
Malware described as possibly preceding Stuxnet and exploiting Microsoft’s software-update mechanism to spy on Iranian systems.
“We discovered Flame, which we believe was maybe the precursor to Stuxnet”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | ATTRIBUTED_TO | National Security Agency | Uncertain | 48 |
| outgoing | ATTRIBUTED_TO | GCHQ | Uncertain | 48 |
| outgoing | USES | Microsoft software update mechanism | Explicit | 98 |
| outgoing | RELATED_TO | Stuxnet | Uncertain | 98 |
| outgoing | ATTRIBUTED_TO | Israel | Uncertain | 98 |
| incoming | ASSOCIATED_WITH | Regin | Explicit | 48 |
Researchers found similarities between Regin and Flame, which the episode describes as a spy tool.
Explicit Confidence 96% · Jack Rhysider EP 48 Details
“Analysis of Regin revealed some similar features to other malware like Flame and Duqu.”
Flame ATTRIBUTED_TO National Security Agency
Flame is described as thought to have been created by the NSA and GCHQ, so the attribution is uncertain.
Uncertain Confidence 78% · Jack Rhysider EP 48 Details
“Flame is thought to be created by the NSA and GCHQ.”
Flame is described as thought to have been created by GCHQ and the NSA, so the attribution is uncertain.
Uncertain Confidence 78% · Jack Rhysider EP 48 Details
“Flame is thought to be created by the NSA and GCHQ.”
Flame USES Microsoft software update mechanism
Flame exploited Microsoft's software update mechanism while targeting Iranian systems.
Explicit Confidence 99% · Nicole Perlroth EP 98 Details
“That utilized – that exploited the Microsoft software update mechanism”
Nicole says Flame may have been a precursor to Stuxnet, while presenting the relationship as uncertain.
Uncertain Confidence 90% · Nicole Perlroth EP 98 Details
“We discovered Flame, which we believe was maybe the precursor to Stuxnet”
Flame is presented as possibly Israeli, possibly US-Israeli, or possibly solely US; the attribution is not resolved.
Uncertain Confidence 78% · Nicole Perlroth EP 98 Details
“that was either US-Israeli or just US or just Israeli”