Yeah, that refers to the MITM attack on the update server. We have no fucking clue what they actually did while they were in the middle - whatever exploit code was running may very well be running right now on compromised machines. Nobody knows what the compromised exes actually did.

Thanks for your nonanswer, though. It was about as unhelpful and unspecific as the original blogpost for this.