Search:

Ah.. Now I understand :D

AFAIK they used an adobe acrobat exploit to install a keylogger. See http://www.securityfocus.com/bid/30035
No names, so it's likely a custom build exploit.

As I said, they probably used spear phishing, not a trojan or any other type of malware.


http://en.wikipedia.org/wiki/Phishing

DNS wasn't really hijacked. They managed to obtain the username/password that allowed them to change the domain.

They probably got those credentials with spear phishing.