In my experience, the botnet didn't upgrade their JVM...it was 18-24 months out of date. THAT was what we filtered on at the F5 to blunt the attack.