No, really, what you say just cannot happen.
>"Depending on the type of cyber attack, this could be possible. If its a phishing attack for example, the information being stolen needs to be sent to a computer under the hackers control. If you can attach some means to piggy back on this info and then send details back of the hackers computer back to the "good guys", then you have your working system."
What does "attach some means to piggy back onto this info" even mean? Data doesn't work like that, it's passive, you can't magically add active behaviour to it. Let's consider your phishing attack in detail, rather than vague hand-wavey metaphors: during a typical phishing attack, the user's PC - either directly under their control, because they've followed a dodgy link and been fooled by a fake login page, or perhaps automatically, because they've been infected by e.g. a banking trojan - does indeed send some data to a computer under the hacker's control. This will typically be done over HTTP by sending a POST request. How are you, as some random third party at a distance across the internet, proposing to "attach" anything to that? It's a transaction taking place between two computers, and you won't even know in advance when it's going to take place; unless you're in control of one of the two endpoints, or you're one of the intermediate ISPs, there's no way you can tamper with the packets. Even supposing you could, what's going to happen to that data at the far end? It gets logged into some DB or CSV file and it just sits there, as a record in a database, with something you've added to it. Data doesn't jump up and start doing stuff all by itself; how is that data you've added supposed to phone home in the way you've suggested?
>"Additionally, even if a botnet is being used, if you can trace back to the infected zombie computer then installing another program on to the zombie is probably less difficult then you would think (the zombie computer probably isnt very well defended in the first place if its already in a botnet)."
This isn't the case either. That computer probably got zombified when the owner double-clicked on an attachment in email, or surfed with a vulnerable browser to a malicious website, or ran something infected they downloaded. It required voluntary action on the part of the operator; there aren't any self-propagating worms to speak of these days. So just because they got themselves infected at some point in the past doesn't mean you can just send something to their machine and it'll be wide open; how are you proposing to get the operator to click on a dodgy link at a time that's convenient to you? And what do you do if they won't play ball?
>"Once on the zombie, it could be possible to trace back to the command and control computers of the botnet."
Yes, indeed that would be the case IF it was possible to get onto the zombie in the first place.
>"So frankly whilst being very difficult tfrom a technological point of view,"
Not just difficult, but impossible in the general case, for the reasons I've explained above. And what is described in the Daily Yomiuri is clearly meant to be some sort of self-propagating virus that jumps from hop to hop through a botnet. This could be done if there's a vulnerability in the botnet client, and you write code to exploit it, but you'd have to do that individually for each different strain of malware, it wouldn't work on any strains that were well enough coded not to have remotely triggereable bugs, and it isn't something that you could code up a generic tool to do automatically in the way that the article suggests.