The Darknet Diaries podcast just released an episode on a similar attack (via MSP) if you're interested in hearing what this looks like from a remidiation standpoint