'The Flame self-destruction plug-in does not delete any SPE files,' Schouwenberg said.

'It is also possible that SPE is part of some sort of main Flame dropper (as yet undiscovered), or is in fact the unknown encrypted payload which was distributed by Gauss on USB disks,' the Kaspersky researchers said.

This is because most of the miniFlame-infected computers have also been infected with Flame or Gauss in the past. The method used to infect computers with miniFlame has not been established yet, but the researchers believe that the malware might be downloaded and installed by Flame or Gauss. Finally, for these 'select' targets, a specialized spy tool such as SPE/miniFlame is deployed to conduct surveillance/monitoring.' Secondly, data is collected from the victims, allowing the attackers to profile them and find the most interesting targets. 'First wave: infect as many potentially interesting victims as possible. So yes, the functionality and intent is different.''If Flame and Gauss were massive spy operations, infecting thousands of users, SPE/miniFlame is a high precision espionage tool,' the Kaspersky researchers said Monday in a blog post that details their findings.MiniFlame can function independently on a computer, but also as a Flame or, more surprisingly, as a Gauss module.Kaspersky researchers had previously established a relationship between Flame and Gauss based on code similarities, but miniFlame's ability to function as a module for both threats represents the most conclusive proof that they are related.'We can assume this malware was part of the Flame and Gauss operations which took place in multiple waves,' the Kaspersky researchers said. 'MiniFlame serves as a backdoor which gives the operator direct access to an infected machine. 'Flame and Gauss are mostly about data and information stealing,' Roel Schouwenberg, a senior researcher at Kaspersky Lab, said Monday via email.

However, the functionality of miniFlame - called SPE by its authors - is different. Security researchers from Kaspersky Lab have identified another piece of malware targeting the Middle East that is likely part of the interrelated cyberespionage efforts behind Stuxnet, Duqu, Flame and Gauss.The malware was dubbed miniFlame because its code suggests that it was built on the same platform as the highly sophisticated Flame threat discovered in May.

Kaspersky malware