Brute-forcing a relatively long passphrase is actually a reasonable accomplishment, especially in secret, and with a limited budget. I will bet 99% that is what he did, and the 'moderately hard' part was in getting resources to run a covert distributed break.