The attacker must have added some high level access, for it to be still ongoing.