The only explanation of what they are doing is "simply put." It appears from the drawings that all they are doing is changing DNS records to point to a secondary server. Except in doing that, if the attack is using DNS to find the target, it does nothing as the change would be available to everyone. If the address is hard-coded, good deal, easy fix, administrators have been doing that for years.
Someone else care to comment with a little more details?