Instead of trying to create viruses and worms that infect as many computers as possible, malware authors are instead trying to infect 5,000 or 10,000 computers at a time to create personalized zombie armies....
....According to Kaspersky, organized criminals are advertising networks of zombie computers for rent on underground newsgroups and Web pages. When they receive an order for a botnet of a certain size, they set about trying to infect computers using infected email attachments or socially-engineered spam with links to malicious Web pages. As soon as they infect enough computers to fulfill the order, they stop using that particular piece of malware...
..."It makes sense to have a discreet number of PCs under your control and be able to sell that on," said Biviano, who added: "With 5,000 PCs under your control--none of which are being destroyed or showing actual qualifiable damage as a result--you will fit under the radar, probably make some money and you probably won't get arrested."...
...."Before releasing the new infected code they test it using antivirus scanners and they don't release the new Trojan or worm if it is detected. I believe that if only 1,000 machines are infected, anti-virus companies will never receive the infected file. That is why antivirus companies have to collect data reactively and get samples as quickly as possible," said Kaspersky.