LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0143: Flame

Flame is a sophisticated toolkit that has been used to collect information since at least 2010, largely targeting Middle East countries. [1]

EnterpriseS0143MalwareObject v1.1Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

S0143: Flame describes [Flame](https://attack.mitre.org/software/S0143) is a sophisticated toolkit that has been used to collect information since at least 2010, largely targeting Middle East countries. (Citation: Kaspersky Flame)

Executive priority

S0143: Flame is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate S0143: Flame by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (Windows), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

  • Official ATT&CK relationships and object metadata
  • Network, endpoint, and security-tool telemetry

Detection direction

  • Validate whether S0143: Flame appears in your detection coverage and tabletop scenarios.
  • Use the object to align executive risk language with SOC, incident response, and detection engineering work.
  • Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

  • Map the object to existing controls and identify missing telemetry or response ownership.
  • Prioritize mitigations that reduce exposure on the listed platforms and tactics.
  • Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Flame

Flame is a sophisticated toolkit that has been used to collect information since at least 2010, largely targeting Middle East countries. [1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

10 rows
DomainIDNameRelationship / procedure
EnterpriseT1091Replication Through Removable Media

Flame contains modules to infect USB sticks and spread laterally to other Windows systems the stick is plugged into using Autorun functionality.[1]

EnterpriseT1210Exploitation of Remote Services

Flame can use MS10-061 to exploit a print spooler vulnerability in a remote system with a shared printer in order to move laterally.[1]CitationKaspersky Flame Functionality

EnterpriseT1123Audio Capture

Flame can record audio using any existing hardware recording devices.[1]CitationKaspersky Flame Functionality

EnterpriseT1011.001Exfiltration Over BluetoothSub-technique

Flame has a module named BeetleJuice that contains Bluetooth functionality that may be used in different ways, including transmitting encoded information from the infected system over the Bluetooth protocol, acting as a Bluetooth beacon, and identifying other Bluetooth devices in the vicinity.[2]

EnterpriseT1036.010Masquerade Account NameSub-technique

Flame can create backdoor accounts with login `HelpAssistant` on domain connected systems if appropriate rights are available.[1]CitationKaspersky Flame Functionality

EnterpriseT1518.001Security Software DiscoverySub-technique

Flame identifies security software such as antivirus through the Security module.[1]CitationKaspersky Flame Functionality

EnterpriseT1136.001Local AccountSub-technique

Flame can create backdoor accounts with login “HelpAssistant” on domain connected systems if appropriate rights are available.[1]CitationKaspersky Flame Functionality

EnterpriseT1113Screen Capture

Flame can take regular screenshots when certain applications are open that are sent to the command and control server.[1]

EnterpriseT1547.002Authentication PackageSub-technique

Flame can use Windows Authentication Packages for persistence.[3]

EnterpriseT1218.011Rundll32Sub-technique

Rundll32.exe is used as a way of executing Flame at the command-line.[3]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1091: Replication Through Removable MediaEnterpriseuses · TechniqueT1210: Exploitation of Remote ServicesEnterpriseuses · TechniqueT1123: Audio CaptureEnterpriseuses · TechniqueT1011.001: Exfiltration Over BluetoothEnterpriseuses · TechniqueT1036.010: Masquerade Account NameEnterpriseuses · TechniqueT1518.001: Security Software DiscoveryEnterpriseuses · TechniqueT1136.001: Local AccountEnterpriseuses · TechniqueT1113: Screen CaptureEnterpriseuses · TechniqueT1547.002: Authentication PackageEnterpriseuses · TechniqueT1218.011: Rundll32Enterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.2
Object version
1.1
Created
Modified
Raw hash
129dd26081db92f2...
Imported snapshots across ATT&CK releases(2)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.21.1Current bundle129dd26081db…
19.11.1Older bundle129dd26081db…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Kaspersky Flame

    Gostev, A. (2012, May 28). The Flame: Questions and Answers. Retrieved March 1, 2017.

    Open source URL
  2. [2]
    Symantec Beetlejuice

    Symantec Security Response. (2012, May 31). Flamer: A Recipe for Bluetoothache. Retrieved February 25, 2017.

    Open source URL
  3. [3]
    Crysys Skywiper

    sKyWIper Analysis Team. (2012, May 31). sKyWIper (a.k.a. Flame a.k.a. Flamer): A complex malware for targeted attacks. Retrieved September 6, 2018.

    Open source URL
  4. [4]
    Flame

    (Citation: Kaspersky Flame)

  5. [5]
    Flamer

    (Citation: Kaspersky Flame) (Citation: Symantec Beetlejuice)

  6. [6]
    mitre-attackS0143
    Open source URL
  7. [7]
    sKyWIper

    (Citation: Kaspersky Flame) (Citation: Crysys Skywiper)

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use