Perhaps they leased a botnet. https://krebsonsecurity.com/2025/10/aisuru-botnet-shifts-fro...

Rent a dedicated server, setup mullvad wireguard on it or whatever. Download stuff to said server using wireguard.

Sure, you can also use Tor. The people engaged in copyright-related illegality generally don't.

I would guess this can be hidden under normal music streaming activity? But one would need lots of proxies!

It's hard to imagine anything but physical egress for that kind of volume.

I mean 300TB is nothing for a streaming service, like it woudn't even show on a dashboard. They probably did that over weeks which is invisible.