He was googling for "how to delete VMs script" to do the initial attack, I think you overestimate his opsec capability.