The malware appears to use a web based command and control server, so there could be a vulnerability in it, a easily brute forced password or even open access. For example, Zeus, the first major banking trojan, would store logs for each infected victim in a folder on its web server. If the owner was careless, these would be exposed in an open directory. If this was the case, the very first folder would almost always be a test infection of the owner, and the very first password capture in it would be the owner logging into the control panel to see if it was working. Good fun back in the day.