This points to using a cheap Linux box at host VPS. AWS micro instances run Linux basically by default and have about 150-250 megabit connections. I assume th

This points to using a cheap Linux box at host VPS. AWS micro instances run Linux basically by default and have about 150-250 megabit connections. I assume they loaded the documents onto a hacked AWS box running WordPress or similar and downloaded them later from there. Hackers almost always tunnel through at least one compromised machine because they don't trust a VPN alone for anonymity. In no way does this imply anyone was or was not responsible. This is a common thing to do for any hacking group