the attacker connected from the management server to a second Tor server, called Switzerland2, through SSH, using an RSA key that, for unknown reasons, investigators couldn’t find among Switzerland2’s authorized keys

That's what really makes my hair stand on end. Is there some vulnerability in ssh they exploited to gain full access, unauthorized?