Thanks, this is the kind of response I was looking for. I was under the assumption, after reading a couple of articles that they were more or less hacking anything they could, and creating a network of vulnerable machines that could then be used as a relays.

I appreciate you taking the time to write this up - I will have to invest some time into going over these sources more carefully.