[slackingoff2017]

This points to using a cheap Linux box at host VPS.

AWS micro instances run Linux basically by default and have about 150-250 megabit connections.

I assume they loaded the documents onto a hacked AWS box running WordPress or similar and downloaded them later from there. Hackers almost always tunnel through at least one compromised machine because they don't trust a VPN alone for anonymity.

In no way does this imply anyone was or was not responsible. This is a common thing to do for any hacking group