What I find interesting is that the specifics of how the hack works are usually less interesting than the concept. Like in this case - the exploit I'm sure has

What I find interesting is that the specifics of how the hack works are usually less interesting than the concept. Like in this case - the exploit I'm sure has been built on a lot of previous exploit-thinking and they simply found a little avenue to get a toehold onto these systems. All the really interesting stuff comes next, from the uniqueness of how complicated and resilient the attack is. Most malware is a numbers game and simply blasts computers in order to install toolbars for profit or whatever. Targeted malware like this is interesting because you can suss out the intent from the choices made. For example: they really, really didn't want to be detected. Carefully constructed PDFs made to look as innocent as possible. Custom code for every computer makes the hack harder to profile. Tiny, tiny downloader. Second, the command center approach. Command centers started out as IRC channels for botnets, but are easy to break up once you know the IRC channel name. So there was a lot of thought put into making the command center resilient to shutdown or takeover attempts. In other words, each node can be controlled and rerouted separately. The one error was the log that allowed the security people to see a list of controlled computers - that is a mistake that will probably be fixed in the future. So for me this is interesting to watch at each step how the hacks are getting more complicated on all levels: the exploit, the control center and the unseen side of it - data gathering/analysis.