Cyber security experts widely believe the Google attacks originated from China.

Dmitri Alperovitch, chief technology officer of security startup CrowdStrike, said his firm has linked the culprits to more recent attacks, including ones last year on EMC Corp’s RSA Security division and Lockheed Martin Corp.

The hackers infected personal computers by exploiting what were major security flaws in commonly used software from Adobe Systems Inc and Microsoft Corp. Such flaws, known as zero-day vulnerabilities, are rare because they are difficult to find. The flaws have since been fixed.

Last year, security experts uncovered eight zero-day flaws being exploited by various hacking groups, according to Symantec.

Symantec said it believed the Elderwood hackers alone have used eight zero-day vulnerabilities from 2010 to 2012 - the largest number it has seen from a single organization. That suggests the group had the money to hire large teams of skilled software engineers or purchase them.

Some experts estimate that a zero-day vulnerability that enables attackers to hack into highly secured systems can cost hundreds of thousands of dollars, even more than $1 million.

The fact that the Elderwood hackers has used so many zero-day vulnerabilities suggests it is either a very large criminal group, or backed by a nation-state, or a nation-state itself, Chien said.