Attackers are also extracting credentials from cloud service providers, marking the first documented instance of Looney Tunables exploitation. The group has a history of quickly adapting its tactics to exploit newly disclosed vulnerabilities.