On May 27, 2012 industry and media outlets began reporting details on a complex targeted attack known as “Flame” or “Flamer”. In some cases, this same threat was previously described as “Viper” or “Wiper”. This, currently active, attack is multi-faceted and in many ways sets a new precedence for recon and data exfiltration within this attack genre.