Their data-dump attacks have been by SQLi, I think; they generally publish the URL of the vulnerable input in their release. They're using other means to root

Their data-dump attacks have been by SQLi, I think; they generally publish the URL of the vulnerable input in their release. They're using other means to root machines, though. My guess is that anybody that took the right classes in college could be doing exactly what they're doing now.