The norforge report sounds like they were targeting magento (e-commerce) sites to steal some $. Darn, was hoping they were trying to swipe DRM keys or something.
Magento is ridiculously complex, open-source, and often self-maintained. It's probably fairly easy to exploit, especially for outdated deployments. And (vs. Wordpress) has payment info to intercept.