but they registered the IOCs in their SIEM platform, so no way this will happen again