The attacks start with the group obtaining people’s AWS access keys ... keys associated with identity and access management ...