FBI Report suggests something, probably an instance, was left opened to the world. Misconfigured firewall is what they said.

It's unclear why the resource couldn't widthstand attack, maybe it had known vulerable software, a weak password, I'm not sure it's been published, but something happened.

Whatever it is was able to assume the *-WAF-Role which had an amazing amount of access.

Given the name of the role and the stupid amount of access, I'd wager it was some shitty security product, but who knows. Maybe we'll find out.