A cross rebel-held Syria last September, an innocuous-seeming image of a man kissing a woman flashed across computer screens. It prompted curiosity and clicks. But as rebels soon learned, the image was actually a virus, and they'd just infected their computers. For months, as Syria descended deeper into chaos and President Barack Obama threatened war, no one knew who had created the virus, or why.
Until now.
The source of the virus, which roiled international press and at first appeared to indict the Syrian Electronic Army, was actually much closer to home.
Computer experts say the Miami company Avesta Networks LLC, headquartered in a beige office building at 7950 NW 53rd St. until it was shuttered last year, was the source of the malware, which opened computers like treasure chests and allowed malicious hackers to make off with all the gold. The connection was discovered by the Electronic Frontier Foundation. The nonprofit organization on December 28 released a report explaining how it used IP addresses to trace the source of the virus. In a message to New Times, the company denies that allegation: "Let me assure you that Avesta Networks was never involved in any sort of criminal act directly and is not planning to do so in the future."
Either way, the attack represented more cyber espionage in a conflict glutted with it. A clandestine group called the Syrian Electronic Army, which supports President Bashar al-Assad, has targeted Western news organizations it perceives as perpetuating bias against him. It's taken on the Washington Post, New York Times, and Associated Press (but not New Times — whew).
Now, Avesta Networks has become the newest culprit in what's become an international match of cyber brinkmanship.
The company's owner, Aria Fahimipour, is a slender Iranian with a wide smile and a well-groomed beard. He didn't return requests for comment, but the Iranian government has expressed open support for al-Assad.
It's unclear what else, precisely, Avesta Networks does, if anything. Its website is broken, no one answered its phone when New Times called, and its Facebook page has exactly nine "likes." The Facebook page declares that the company offers "multi location hyper-v hosting solutions."
"It's clearly a shell company," says Dave Mass of the Electronic Frontier Foundation, which has investigated Avesta. Mass says the Miami company is "pumping out Trojans and viruses and targeting Syrian activists... It's just strange."
It's unclear whether Fahimipour authored the viruses. The only digital words he's left behind are in a comment about a YouTube video called "A Night in Tehran Allah."
"The only thing we have is GOD!" Fahimipour wrote. "We are all with you, all over the world. God is great!"
