As has been proven many times before, "very sophisticated", "advanced", "highly complex" etc. actually generally means "our staff was humiliatingly negligent" in some regard. i.e. they were spearphished and the attacker pulled a password database from their internal network. It seems very odd that they resorted to resetting all passwords instead of just affected or potentially affected accounts as Github did recently.
Well since its a botnet that is trying to login with lots of different passwords and lots of different accounts its fairly obvious what the attack vector is. That's also why its safer to force a password reset than to just continue to reset passwords after they get compromised.
