It's not their password, per se, it's just using low-entropy (=common) passwords to get access where people were lazy. And the best way to find common password

It's not their password, per se, it's just using low-entropy (=common) passwords to get access where people were lazy. And the best way to find common passwords is by using frequency analysis from prior breaches. It's definitely clever, but it's also not super innovative - kind of a standard tool in the toolbox.