Available evidence suggests vulnerability exploitation has replaced botnets as a prime infection vector.