H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Flame](https://attack.mitre.org/software/S0143) is a sophisticated toolkit that has been used to collect information since at least 2010, largely targeting Middle East countries. (Citation: Kaspersky Flame)

Labels

malware

10 recorded

Relationships

uses

to Audio Capture

Technique

uses

to Authentication Package

Technique

uses

to Exfiltration Over Bluetooth

Technique

uses

to Exploitation of Remote Services

Technique

uses

to Local Account

Technique

uses

to Masquerade Account Name

Technique

uses

to Replication Through Removable Media

Technique

uses

to Rundll32

Technique

uses

to Screen Capture

Technique

uses

to Security Software Discovery

Technique

7 external

References

mitre-attack

S0143

open

Flame

—

sKyWIper

—

Flamer

—

Kaspersky Flame

https://securelist.com/the-flame-questions-and-answers-51/34344/

open

Crysys Skywiper

https://www.crysys.hu/publications/files/skywiper.pdf

open

Symantec Beetlejuice

https://www.symantec.com/connect/blogs/flamer-recipe-bluetoothache

open