I'd bet that they had most ports blocked and the attackers used multi-stage tunnels. Details like that probably just don't make it into a Wired article.