[thaumaturgy]

I'm assuming that they were asked to compromise a typical tightened corporate network, in which there's only a single external address -- the firewall's -- and therefore that's the only address they had to work with.

In that case, compromising one of the clients behind the firewall is the typical next step for an attack. (They did a heck of a nice job on that, though.)