apt

miniFlame (SPE)

defunctAttribution: ModeratePlausible and partly corroborated — some gaps or single-source elements.

APT / State-sponsored

SPEJohnminiFlame

Attribution

Attributed to a sophisticated nation-state cyber-espionage operation. Kaspersky Lab established a direct code and infrastructure link to the Flame and Gauss platforms (miniFlame was codenamed 'SPE' inside Flame's original C&C servers and referenced as 'John' within Gauss configuration files), placing it inside the same 'cyber-weapon factory' as Flame, Gauss and — by extension — Stuxnet/Duqu, the toolset widely reported to be part of the US-Israel 'Operation Olympic Games' effort. Kaspersky did not formally name a sponsor state. Confidence: medium (strong technical linkage to Flame/Gauss; state sponsorship inferred, not formally confirmed by the vendor).

First seen

2012 (publicly disclosed by Kaspersky Lab in October 2012). Kaspersky identified six variants dating to 2010-2011, with analysis suggesting development may have begun as early as 2007.

Last active

2010-2011 (samples), disclosed 2012; no activity observed since. Considered historically dormant/defunct.

Motivation

Cyber-espionage — targeted intelligence collection, data theft and remote surveillance against a small, hand-picked set of high-value victims.

Attribution confidence

medium

MENA targeting

Lebanon, Palestinian Territories, Iran

Sectors

Targeted individuals / high-value espionage

Why it mattersState-sponsored / APT actor, medium confidence, documented targeting Lebanon, Palestinian Territories, Iran (Targeted individuals / high-value espionage sector).

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

Associated with

Related to

Stealth FalconactorTechnique overlap
Flame / FlameractorTechnique overlap
Dark CaracalactorTechnique overlap
Arid Viper (APT-C-23 / Desert Falcon)actorTechnique overlap
WIRTEactorTechnique overlap
Tropic TrooperactorTechnique overlap
Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroffactorTechnique overlap
APT39 / ChaferactorTechnique overlap

Coverage robustness · vs this actor

How evasion-resistant our detection coverage is against miniFlame (SPE)'s techniques — Summiting the Pyramid scores analytics (1 brittle – 5 robust); the actor inherits through its TTPs. This is a detection-engineering metric, not an attribution signal — see Attribution for confidence.

Techniques with a robust rule

Techniques with any detection

6 / 12

Mean robustness (of covered)

Useful?

Uses

Application Window DiscoverytechniqueATT&CK mapping
Encrypted Channel: Symmetric CryptographytechniqueATT&CK mapping
Shared ModulestechniqueATT&CK mapping
Indicator Removal: TimestomptechniqueATT&CK mapping
Native APItechniqueATT&CK mapping
Replication Through Removable MediatechniqueATT&CK mapping
Software Discovery: Security Software DiscoverytechniqueATT&CK mapping
Event Triggered Execution: Component Object Model HijackingtechniqueATT&CK mapping
Application Layer Protocol: Web ProtocolstechniqueATT&CK mapping
Screen CapturetechniqueATT&CK mapping
Exfiltration Over C2 ChanneltechniqueATT&CK mapping
Data from Local SystemtechniqueATT&CK mapping