The hack seems to be via engineers laptop.

This attack vector has become so common and funny.

In one scenario, i remember a company got hacked because an engineer downloaded a RAT package on company laptop during fake interview and asked him to keep it running for days as part of the interview process while they stole the data.