The time between blocks, and thus also mining difficulty, is determined according to block timestamps. The problem with this is that according to Ethereum's consensus laws miners have a certain degree of freedom when setting them, and can even set false timestamps.

The same consensus laws say that in case of ties between blocks of the same height, the block with a higher total mining difficulty should be picked to be the parent of the currently mined block, while the other one should be its uncle

Thus, a miner who wishes to replace the last block on the blockchain can mine a new block of its own which has a timestamp that is low enough to increase the block’s mining difficulty.

One can even preemptively mine blocks with such timestamps to make sure they win in case of ties with other blocks which might be mined concurrently, or which might’ve been mined but haven’t reached the attacker yet