UNC6780

Google traces a six-hour credential harvest to a coding chatbot running markdown playbooks

A human broke in and assembled the framework, and after that the scanning, the retries and the address rotation ran on their own out of the victim's own IPs. That middle stretch is what response clocks have to survive.