Threat Actor OPSEC Failures

Investigations built from attacker infrastructure the operator exposed themselves, such as open HTTP directories and preserved shell history.