Be sure to read the source: intelreport.mandiant.com/Mandiant_APT1_Report.pdf I'm only part way through, but I find it hard to believe that only micro$loth computers are used as the attack OS. Maybe I haven't gotten far enough through report to find the part where they use the *nix boxes? scott