The Conficker Worm, supposed to be launched on April 1st, was reported by 60 Minutes and SecureWorks as the work of a Russian cybercrime gang. After the video of the group was posted, numerous comments posted in regard to the video revealed that the gang of teens were actually of Finnish nationality and not Russian. Tracking the origin of attacks is an important aspect of internet security to prevent future attacks.
April 1st scenario:
The worm was programmed to begin actively visiting 500 out of 50,000 randomly generated web addresses to receive new instructions on April 1st. Some security experts hypothesized that the worm will not do much destructive work on April 1st--instead it will receive instructions. This may be due to the large amount of attention this worm has been getting--perhaps there will be more defensive tactics set in place by its programmers at this stage. Source of opinion: Symantec and PC World.