I think the most likely explanations are that the hackers either exploited an unpatched application using Apache Struts or exploited a SQL injection vulnerabili

I think the most likely explanations are that the hackers either exploited an unpatched application using Apache Struts or exploited a SQL injection vulnerability in an application using Apache Struts.