https://www.rapid7.com/blog/post/tr-crimson-collective-a-new-threat-group-observed-operating-in-the-cloud/ Skimming this post I think we have everything covered but would be worth checking more in depth.