You can _not_ do it remotely tough, you have to upload the bomb on their system and install it first... and it has to actually run to make damage, like with the money virs that collect HPD in time, the malware collects attack power
Precisely, if they are active they will have some time to see it coming