Is the implication that there must be someone who connects the special USB drives to these air-gapped computers? So the attacker must have local people on the ground.
It says that the CD, containing data about a recent research expedition, was mailed to an academic. It was apparently intercepted in the mail, compromised, and forwarded on.
Also, this thing was running as a local admin on a domain controller. So either the DC's weren't patched or some zero-days were used. Or perhaps an inside job.
As I understand it, airgapped systems are not in the habit of bringing software updates across the airgap, so unpatched everything is likely.
If the WSUS server were also air-gapped, then you're in the business of manually downloading each update, verifying it, and copying it to over to the air-gapped WSUS server offline.
Microsoft's Windows Update servers have also been compromised in the past. Depending on the level of security you're operating at, taking new windows updates on your air-gapped systems may require having someone decompile and review each update.
In general, being air-gapped prevents infinitely more exploits than windows updates could ever possibly cure; that is, until one of your admins uses his admin privileges to disable the USB port restrictions for 5 minutes that one time to copy that one file quickly so he can go home for the day. For this, there are epoxied USB ports.
To nitpick, domain controllers don't have local accounts at all. It was probably running as SYSTEM which equates to the domain controller's computer account for AD.