My interpretation of the article was that they identify prior to attacking.

I suppose they could use a "spray and pray" attack on anyone using Tor, but that would be easily detected.