The attackers are using features built into the firmware. They don't have to install any of their own software.

It's accessing the router via the built in SSH server, so no malware needs to be installed on the router.

It's a bug or a misconfiguration, here a misconfiguration included in default config.