Heise has an article (in German) about a web attack toolkit called MPack. The article goes on to mention that one of the trojans installed via MPack and the IFrame exploits is called Torpig, which originates from Russian Business Network (RBN) (that same information can also be found in the SANS article linked above).

One more reason to block these guys ...