The Sandman group’s main malware is among the very few that use the Lua scripting language and its just-in-time compiler.