The organization conducting the MitM likely has physical access to the machine already. The original post indicates the link on the network interface went down

The organization conducting the MitM likely has physical access to the machine already. The original post indicates the link on the network interface went down for 19 seconds, indicating a device was placed in front of the server.