The attackers are using features built into the firmware. They don't have to install any of their own software.