No, it wasn't a FTP-based attack because we analyzed the FTP logs and on all the cases, there was no connections during the time of the attack. In our first as

No, it wasn't a FTP-based attack because we analyzed the FTP logs and on all the cases, there was no connections during the time of the attack. In our first assessment, we checked around 1.5k sites and found 140 infected. We also found their CEO blog hacked and some other big sites hosted in there with the same malware. As we published the post and started to hear from people, the number of affected sites grew to the hundreds (close to 1k). Google says they have 240k sites, which means that we identified =~0.4% of their sites with malware. Those are only the ones WE identified, which is probably much less than the actual number. Also, we contacted them about this issue before posting (via their forms) and also reached out to the CEO. However, since sites were already infected, we posted explaining the issue and how to fix it. We didn't posted about any vulnerability that could help the attackers, only information to help the affected users.