Virus Named after Islamic Messiah Found in Iranian and Israeli Systems

Yet another virus primarily targeting countries in the Middle East has been discovered, this time called Mahdi, after the Islamic Messiah who will, according to Islam, rule the earth before the Day of Judgment.

Much like the astoundingly complex virus known as Flame, this virus can be modified remotely by the attacker in order to record keystrokes, remove documents, monitor email communications and even record audio.

However, according to Costin Raiu, senior security researcher at Kaspersky Lab, this piece of malware is not sophisticated, unlike Flame.

The malware originally was spotted “several months ago” and has targeted over 800 systems with the vast majority in Iran, with Israel coming in a distant second, according to Israeli Seculert and Russian Kaspersky Lab.

Interestingly, on Seculert’s July 17 blog they revealed, “The variant we examined communicated with a server located in Canada. We were able to track variants of the same malware back to December 2011. Back then, the malware communicated with the same domain name, but the server was located in Tehran, Iran.”

The potential similarities between Flame and Mahdi were so striking that Seculert originally contacted Kaspersky Lab in order to examine the two pieces of malware, although ultimately they “couldn’t find a direct connection between the campaigns.”