The threat actor has been compromising cloud environments at scale with automated worm-like attacks on exposed services and interfaces.