Unpatched vulnerability, persistent tooling, deleted logs. The deletion is a finding in itself — nobody spends that effort on a boring record.
The patch had existed for two years. The campaign needed no new capability, only servers nobody had looked at.