If you go to Nart Villeneuve's  blog <a href="http://www.nartv.org/" rel="nofollow">http://www.nartv.org/</a>, which Google's blog post linked to, he's got a cool pdf on tracking GhostNet (Chinese government cyber-espionage network). The command and control servers that were discovered in earlier attacks do in fact operate this way.<p>In tracking Chinese infiltration of the Tibetan movement, they discovered compromises in various embassies and other organizations in countries all over the world.