One of the images [0] in the article identifies a C&C server used by the attackers, technology-revealed.com. The script appears to embed an invisible iframe pointing to a page on that domain, which probably infects the machine using some zero-day exploit on the browser or one of its plugins. The domain is still registered, but appears not to be running an HTTP server anymore. Might be interesting to investigate if someone wants to look into that.

[0] http://cdn.arstechnica.net/wp-content/uploads/2015/02/malici...