Nobody knows. But the attacker has to have root privileges to install the rootkit. So the usual suspects are weak password and unpatched software.