Why is everyone assuming its a bot-net? Is there any proof? It could just be a that there are some people are solo mining instead of using pools. Difficulty is low enough that a single GPU could find a block every 1-3 days (rough estimate), which may be worth it to save ~1% from pool fees. Another possibility is there are some pools that haven't been made public.