There is nothing of substance to this attack? Just ssh credential stuffing and $env overwriting is the only "novel" evasion technique and it's really not that b

There is nothing of substance to this attack? Just ssh credential stuffing and $env overwriting is the only "novel" evasion technique and it's really not that bad, EDR software can easily detect that this is happening and it likely only happens on malware.