Iran claims to have been targeted by second worm
Posted on 26.04.2011
If a statement from Gholam-Reza Jalali - the head of Iran’s Passive Defense Organization - is to be believed, it seems that Iran's computers have been targeted by a new computer worm dubbed "Stars".

According to him, the worm has been spotted and is currently being investigated by experts, and even though he doesn't say if it's tied in any way to the Stuxnet worm, he mentioned that they discovered it is compatible with the targeted system and that the damage is very slight in the initial stage of infection.

Tehran Times reports that he also said that the worm is "likely to be mistaken for executable files of the government," although I have noticed that many Western news sites report him saying that it might be "mistaken for some executive files of government organisations," spurring the speculation that it might be masquerading as a .pdf or .doc file.

But the lack of details and the failure of obtaining a sample of the malware make it impossible for Western computer security experts and companies to confirm Jalali's claim.

"We can't tie this case to any particular sample we might already have," says F-Secure's Mikko Hypponen. "We don't know if Iran[ian] officials have just found some ordinary Windows worm and announced it to be a cyber war attack."

"Outside of the published news reports, McAfee has no information on “Stars” at this time. That’s different from Stuxnet, where international cybersecurity companies knew of the malware and were able to investigate it through customary sharing of malware samples, says McAfee's Joris Evers. "We currently have no way of verifying the attack the Iranian government is reporting, nor do we have any way of identifying who might be behind the attack or what the target could be.

It is, of course, possible that security vendors do have a sample of the malware in their possession, but are unable to identify it because they lack crucial information about it. It's obvious that Iran will have to provide a sample of the worm to outside experts if it wants its claims to be taken seriously.


Email scammers stole $215M from businesses in 14 months

Posted on 29 January 2015.  |  In 14 months there have been nearly 1200 US and a little over 900 non-US victims of BEC scams, and the total money loss reached nearly $215 million.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Fri, Jan 30th