We peel back the layers on a threat we detected involving an adversary who brought their own virtual machine into an environment following an aggressive spam bombing attack.