Varied cloud infrastructure was used to phish email credentials, monitor for and forward finance-related messages and automate operations.
Source: Threadpost