A massive, highly sophisticated piece of malware has been newly found infecting systems in Iran and elsewhere and is believed to be part of a well-coordinated, ongoing, state-run cyber-espionage operation.

The Flame computer virus not only stole large quantities of information from various Iranian government agencies, but apparently even disrupted its oil exports by shutting down oil terminals, information security firm Symantec Israel said yesterday.

The Flame virus recently found in Iran could be used to infect other countries, according to the International Telecommunications Union. As the United Nations agency charged with helping members protect their data networks, the ITU plans to issue a warning about the danger of Flame.

Iran's National Computer Emergency Response Team (Maher) said in a statement that the detection and clean-up tool was finished in early May and is now ready for distribution to organisations at risk of infection.Flame was discovered after the UN's International Telecommunications Union asked for help from security firms to find out what was wiping data from machines across the Middle East.An investigation uncovered the sophisticated malicious programme which, until then, had largely evaded detection.

The virus is about 20 times the size of Stuxnet, malware that targeted the controls of an Iranian nuclear facility. The largest concentration of infected machines is in Iran, followed by the Palestinian-controlled West Bank, Sudan, Syria, Lebanon, Saudi Arabia, and Egypt.

According to the crysys report on sKyWIper (aka Flame):