Apparently the malware used three backdoors, given the reporting that it was in the wild for 7 years I can't help but think they were zero day exploits.

http://www.wired.com/threatlevel/2014/02/mask/