[BCSE]

One thing to consider on how this happened is that someone's computer who has access to these various X-cart sites was infected with a keylogger virus which inturn provided ftp info to many sites. So it wouldn't necessarily have to be a helpdesk intrusion. Could simply be a PC intrusion on a key person or group of people.

We've had one client that we know of that has had this problem, and from our experience with them, there was no evidence in an X-cart vulnerability allowing them in. There was no suspicious activity noted in the http logs. Only activity in the ftp logs. They were also up-to-date on the security patches except for the ones this summer which they had scheduled to do right at the same time this was found. That client also got infected by their *own* site by the keylogger (or possibly they were infected before the attack which provided the ftp information, I don't think we know when they got infected).

Carrie