Based on this I'd say they didn't realize until some suspicious VMs started popping up...

Wonder what their time to detect was