The article says he’s exploiting known (ancient) vulnerabilities
(Of course, there could be deeper ops from the CISA side, but if their only cost is having to lose older vulns, so be it.)
In the extremis they can always bring in the orbital cannons and overwhelm them of course.