Many of the attacks originate in China, using underground marketplaces that sell access and sensitive data to other cybercriminals.