@snkhan @chronovore @GossiTheDog _very_ hypothetically: it could be a supply chain attack. The systems could already be compromised, and there's a script waiting in a cron job to execute. That would explain the time window, and why they're saying there's no "vulnerability"