Mahdi (malware)

Seculert and Kaspersky named the malware after "Mehdi" because the attackers put a folder with the same name in the infected computers in order to spread malware. According to the security experts, Mahdi malware works apparently at a lower level than Stuxnet and is made using existing public softwares.

Targets

The targets of this malware include sensitive infrastructure companies, computers of engineering students, financial service institutions, and official government embassies. The most infection with this malware has been reported in Iran.

Mahdi malware allows attackers to steal files from an infected computer and monitor emails and text messages/chats. It can also record sounds, register keys pressed on the computer keyboard and take pictures of the activities shown on the computer monitor screen. Also, a text file named "mahdi.txt" is included in the malware program on the infected computer.