https://www.youtube.com/watch?v=FpOH0lxEGBE
They seem to be remotely accessing the machine to both set and then use the root account.