I would guess that their cyber offensive operation computers, which if I were to design from a systems level their IT department probably is distinct from other parts of their network, is different than their intelligence gathering and storing methods because sources and methods are the most tightly held secrets of any intelligence agency.

Plus you probably don't want your computers that you're using for offensive operations to look any different than a normal computer on the internet.. so my guess is that is that there was an exploit of an offensive computer somehow through that back to a secured network where those tools were developed and deployed... probably through the method of remote command and control.

I'm surprised they haven't found the method of infiltration yet. But my guess is they should seriously look into unknown vulnerabilities. But it's also true (if Wikipedia is to believe believed) that agencies work together in joint operations. In that case it would only take one rouge agent to get physical access to leaking materials that would effect both agencies if they were part of the joint operations.

A) this doesn’t require a rogue agent, just an insecure one. B) you just need the same attack to work twice; less extraordinary than an uncorrelated coincidence C) possibly some might have access to both. I think this is unlikely, but again, less unlikely than an uncorrelated coincidence.