A new component discovered by researchers at Chronicle, a cybersecurity company owned by Google parent Alphabet, suggests that a fourth team was involved in the early development of the notorious Stuxnet malware.
Stuxnet, believed to have been developed by the United States and Israel, is a worm designed to target industrial systems. It became known as the world’s first cyber weapon after it caused serious damage at Iranian nuclear facilities.
Stuxnet has been extensively analyzed and researchers have found ties to several other threats, including Duqu, Flame and malware developed by the NSA-linked Equation Group.
Chronicle has introduced the concept of Supra Threat Actor (STA), which describes threat actors representing multiple countries, institutions or groups.
The STA that is believed to have developed Stuxnet has been dubbed GOSSIPGIRL. Chronicle’s discovery of a new Stuxnet-related component, named Stuxshop, revealed that the GOSSIPGIRL STA included not only Duqu, Flame and Equation, but also a fourth group linked to Flowershop, a malware platform that was active between 2002 and 2013, primarily in the Middle East.