[dminor]

If you go to Nart Villeneuve's blog http://www.nartv.org/, which Google's blog post linked to, he's got a cool pdf on tracking GhostNet (Chinese government cyber-espionage network). The command and control servers that were discovered in earlier attacks do in fact operate this way.

In tracking Chinese infiltration of the Tibetan movement, they discovered compromises in various embassies and other organizations in countries all over the world.