[NL807]

I reckon they used a good old fashioned honeypot. Seed a torrent of some random popular content that also contains malware payload, and let users download it.