They're both. Even with willing ISPs and countries on all sides, the attacks continue. Machines are far to insecure, which makes it far too easy for an indivi

They're both. Even with willing ISPs and countries on all sides, the attacks continue. Machines are far to insecure, which makes it far too easy for an individual or small group to harvest the resources of millions of machines and then hide, while giving them orders. It's when they try to collect money that law enforcement has the best opportunity to catch them. There is a monetary limit over which it becomes internationally interesting to the FBI,HTCU, etc, to get involved and start using international resources to track the money back and make arrests.