Yet the most interesting aspect of Flame is the strategic ways it differs from Stuxnet. As a weapon, Stuxnet was a tool conceived in urgency. Every piece of malware has to balance virulence with stealth. The more aggressively a worm propagates, the more likely it is to be caught. Stuxnet was designed to spread at a fairly robust rate. Its creators wanted it to get on lots of different computers and they were willing to risk quicker discovery on the chance that the worm would find its way to the very specific system it was meant for and deliver its payload. In the end, Stuxnet’s engineers made a good trade. Because it eventually spread to 100,000 computers, Stuxnet was caught reasonably quickly. Yet this aggressive approach got it to its target​—​Iran’s Natanz refinery​—​where it wrecked at least a year’s worth of work.

Flame, on the other hand, is a study in stealth and patience. Unlike Stuxnet, with its single-minded search for a specific computer system, Flame seems to have wandered in many directions: onto computers used by governments, universities, and private companies. It moved slowly, and the overall number of infected systems seems to be quite low. Current estimates put it at 1,000 computers, nearly all of them located in Iran, the Palestinian territories, Sudan, Syria, and Lebanon. Flame kept the number of infections low because it never moved from one computer to another without explicit instructions from its C&C…

[O]nce Flame was running, it was like something out of science fiction. Flame could watch a target even when he was completely alone. It could listen to every word he said on the telephone, or through Skype, or to a colleague walking past his desk. It could rifle through his computer files and find any document. Or peek into a cell phone sitting in someone’s pocket in the next room. It never had to worry about getting caught in the act. And on a moment’s notice, it could erase any sign that it was ever there. It kept up constant communication with its handlers, even when they were thousands of miles away, and it always followed orders.