discovered 2026-07-22
Staged stolen-data archive (ditto -c -k) uploaded over chunked HTTPS PUT, then rm -f'd for anti-forensics.