http://www.securelist.com/en/blog/750/Full_Analysis_of_Flame_s_Command_Control_servers
For a quick take-away of what the blog says, skip to the end where it's all summarized:
Conclusions and summary findings:During our joint investigation with industry partners - Symantec, ITU-IMPACT and CERT-Bund/BSI - we uncovered a number of things previously not known about Flame and its associated platform:
The development of the platform C&C code started as early as December 2006.
The source code comments indicate at least four programmers: [D] censored, [O] censored, [H] censored and [R] censored.
The most recent source code change was made on May 18, 2012 (LogWiper_fixed.txt, Constants.py).
The C&C code handles four different malware - named SP, SPE, FL and IP by the authors. It also handles three communication protocols (OldProtocol, OldProtocolE, SignupProtocol).
Of the four malware, only Flame is known; the other three are currently unknown.
For communication, Flame uses "OldProtocol".
An unknown, Flame-related malware named SPE exists and is in-the-wild.
Flame is not the most "modern" of the malware known by the C&C code.
The most recent malware is called "IP" and it is yet unknown.
The code is/was still in development; a new protocol called "Red Protocol" is not yet fully implemented.The details disclosed in this blog post indicate several important facts. First of all, the work on these cyber-espionage projects started earlier than previously estimated - as early as 2006. Secondly, the code which handles the requests is complex and uses encryption heavily. The programmers who worked on it tried to make it seem like a legal CMS platform. Last but not least, the stolen data is encrypted on the server in such a way that only the attackers can read it, through strong public key cryptography. These features are not normally found in malware created by everyday cyber-criminals, reaffirming our initial conclusions that Flame is a nation-state sponsored attack.
Based on the code from the server, we know Flame was a project from a list of at least four. The purpose and nature of the other three remain unknown.