Comment by IanCal

That was the second step, the first was finding a 0 day exploit in artifactory.

> did they truly "discover" it, or did someone type some prompt like "if you use an http mirroring service, you can construct urls that contain code"

None of the investigations looking at the logs show that, and they were doing benchmark tests.