Use CISA's official AA23-353A advisory, including the February 2024 revision. Verify the Sphynx update, identity artifacts, adversary-in-the-middle tooling, remote software, defense evasion, data transfer, and note convention.