VPS_IP_IOC ref: https://www.secureworks.com/blog/supernova-web-shell-deployment-linked-to-spiral-threat-group https://www.domaintools.com/resources/blog/examining-exchange-exploitation-and-its-lessons-for-defenders