An attacker doesn't need an internet connection if they are persistent enough...