I guess I should have led with the statement that we dealt with this a lot 1-2 years ago and these aren't live currently. Unfortunately it was just mentioned at

I guess I should have led with the statement that we dealt with this a lot 1-2 years ago and these aren't live currently. Unfortunately it was just mentioned at the end. My post was more to illustrate an example of how this had been done in the past and briefly explain the tactics of how the threat actors were able to do it.