Use CISA's official AA23-136A advisory, including its updates. Verify the access and tunneling tools, named vulnerability, discovery-tool functions, credential-harvesting evidence, defense-evasion changes, and dates of the group's operational shift.