3 ms·

I believe the issue was related to the fact that the user running Jenkins was a full passwordless sudo user. Maybe the attacker used the groovy console too...