In the recent New York Times attacks, how did the attackers gain access to the server?
Additionally, is there any evidence that these attacks were launched by China, aside from the proxy?
This question is unlikely to help any future visitors; it is only relevant to a small geographic area, a specific moment in time, or an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet. For help making this question more broadly applicable, see the FAQ.
The article you linked to gives as much information as is publicly known. So I'll just quote from there:
Which means that this isn't software you're going to find on metasploit. It's something custom that they built.
So, 3 employees workstations compromised with RATs (probably via email spear phishing) leveraged to gain access to the domain controller.
Active Directory is known to use unsalted hashes for password storage. There are several methods AD uses for hashing passwords, none of them very secure ... except perhaps as compared to the previous ways Microsoft hashed passwords. Their security is based primarily on the assumption that Windows access controls will prevent the attacker from retrieving the hashes. But if the attacker uses a targeted phishing attack to compromise the workstation of someone who has the necessary access, then AD won't put up much further resistance, and the attacker can then learn everyone's password.
After cracking the passwords stored in AD, the attackers then have the necessary credentials to do whatever they want to do. In this case, read email.