[nom]

It's not hard to get an anonymous server with a good downlink (you can also distribute it across many machines). What make things complicated is that you must assume that there are admins on the victims side and you don't want to get noticed. I guess the attackers either inspect the network to assess them, or they just start slow and if nobody notices the upstream for days or even weeks, they can crank up the speed.

Cellebrite's sysadmins didn't do their job, that's for sure.