Use CISA's official AA23-158A advisory. Verify the campaign timeline, the vulnerable product and CVE, LEMURLOOT's filename and request authentication, its database and Azure capabilities, and the privileged account values it creates or deletes.