The Fanny worm, the malware that preceded Stuxnet in the methods used to infect and spread from one machine to another, has been publicly available for download since July 13, 2010.
Designed for USB drives, the worm is the creation of Equation, as named by the researchers at Kaspersky, in the most complex cyberespionage group that has appeared to date, and notably with a composition date from mid-2008.
Analyzing the entire set of tools used by the Equation group, researchers' attention fell on Fanny due to its obvious correlations with Stuxnet, because it also affects LNK files on Windows.
Stuxnet is malware that targets Siemens SIMATIC Step 7 or SIMATIC WinCC software, used in industrial control systems (ICS) at the uranium enrichment facility in Natanz, Iran.
Although Kaspersky found the traces of the Equation group in early 2014, which is when it started analyzing the tools and methods, the Fanny worm is in the public eye, ready to be used, on a Malaysian forum that ranks 17th in the country, according to data from Alexa.
A user actually requested immediate help regarding a virus that started running from a USB drive on a Windows system, with all available patches and the autorun and autoplay functions disabled.
An analysis of the issue published by VirusTotal shows that most of the antivirus software (48/57) used for detection are capable of finding the Fanny worm inside the system.
