Flame attack on Iranian oil ministry

Flame (also Flamer / sKyWIper) was a sophisticated cyber-espionage toolkit publicly disclosed by Kaspersky Lab and Iran's MAHER CERT in May 2012 after wiping data from systems at Iran's oil ministry and the Kharg Island oil terminal. The malware combined keylogging, screen capture, microphone activation, and Bluetooth scanning, and shared development origins with Stuxnet.

Terabytes of data were reportedly exfiltrated from Iranian energy-sector systems; the Kharg Island oil terminal was disconnected from the internet during cleanup, briefly disrupting export operations.