Have a look at their timeline. Very impressive, 3 mins from first sign (2 mins from first report), the domain is blocked.
(Edited a bit for brevity & mobiles)
> 22:49 UTC Attacker sends out 100+ SMS messages...
> 22:50 UTC Employees begin reporting SMS messages...
> 22:52 UTC Verify that the attacker's domain is blocked in Cloudflare Gateway for corporate devices.
> 22:58 UTC Warning communication sent to all employees across chat and email.
etc