It's not. There's no exploit code sent, just random bytes and the replies are discarded.

I think they're attempting to evade brain-dead automated protocol inspection, not trying to fool a human.

They're not. The connections are far too infrequent (15 connections, then sleep for 30 hours).

Yeah, that's why most banking fraud trojans that target U.S. banks are compiled on Russian-language PCs and connect back to Russian-developed webserver software. I'm afraid your "well-established" fact doesn't ring true with anyone that actually tracks banking trojans for a living.

Ah yes, as hilarious as the first hundred times I've seen that joke posted about me. Maybe I _should_ just change my name to !jonstewart...

-Joe

Your scenario of corporate chaos isn't accurate when it comes to Storm. Storm isn't self-replicating; it doesn't spread to other internal systems. It can however steal email addresses and possibly other external systems will begin to send Storm social-engineering emails to the rest of the company. However, if you have a sane firewall policy that doesn't allow arbitrary high-port UDP traffic outbound and inbound, the Storm node will never be able to link up to the rest of the botnet, rendering it more of a noisy annoyance than a threat to the company's data.