The exact timeline of events (all times UTC) Jul 31, 19:51 — Initial unauthorized access. First service account key minted from a Brazilian IP block. No prior legitimate use of that credential from that source. Jul 31, 21:03–23:45 — Privilege escalation & persistence. Jul 31,