The Demon Flame, the Fake Update

Legend

Discovered in May 2012 mainly in Iran and the Middle East, it was a huge modular espionage toolkit: it recorded audio, screenshots, keystrokes and Bluetooth data. It spread by posing as Windows Update, thanks to a Microsoft certificate forged with an MD5 collision. After its discovery, its operators made it self-destruct.

Exorcism

Cast it out by retiring weak algorithms like MD5 and checking where updates come from. Quickly revoking compromised certificates closes the door it used.

Technical record

Also known as: Flamer, sKyWIper
Circle: Circle V · State espionage
First seen: 2012
Status: Dormant
Weapons (exploited CVEs): Saint Stuxnet LNK
Works: The Scourge of the Flame

A large modular espionage toolkit publicly discovered in May 2012, mainly in Iran and the Middle East, able to record audio, screenshots, keystrokes and Bluetooth data. It spread through fake Windows Update using a forged Microsoft certificate created with an MD5 collision attack. Its operators sent a self-destruct command shortly after its exposure.

Sources: attack.mitre.org · en.wikipedia.org · MITRE ATT&CK reference S0143