So the hacker did nothing but install malware on the server that would let him use it later in DDoS attacks against other sites. Sounds like somebody found that one via random pinging/host negotiation and probably had no idea he was even on a government computer.