transmit can be scripted so it could be anything running on the machine that is backdoored. i assume they had connection for sending commands that was separate

transmit can be scripted so it could be anything running on the machine that is backdoored. i assume they had connection for sending commands that was separate because the sftp sounds like it was blocked but the uploading stopped apparently in response to external stimuli. seems kind of lame to have some kind of connection sending commands and then using transmit to upload files.