The attack likely starts with a computer used by the network operations staff being compromised and a key logger or other credential theft tool being installed.

The attack likely starts with a computer used by the network operations staff being compromised and a key logger or other credential theft tool being installed. It is much easier to own an admins laptop with a PDF exploit than to find a remotely exploitable Cisco vulnerability. Routers usually sit outside the firewall in typical network designs. The backdoor listens to raw network traffic coming in for the trigger, before any firewall rules on the router itself are processed. All in all, it is very well designed and part of an extremely advanced attack.