Many of the infected systems were accessed through a vulnerability in the Magneto CMS. A patch was issued to close this security hole on October 31st, but not all users will get the new version installed right away. The funds from the first wave of attacks could also be used to purchase a previously undisclosed exploit, which could widen the scope of attacks.