the infrastructure that frames these these spy machines generally points in one of two directions: one group’s infrastructure points back to Shanghai, the other to Beijing.

“There have to be hundreds of people involved, just to maintain this amount of infrastructure and this much activity and this many spear phishes, collecting so many documents, and writing this much malware,” Stewart said