[sneak]

I am willing to bet money that NSO Group has multiple AWS accounts, many under several layers of cover.

You can't really spin them up with any significant quota on short notice (ask me how I know, AWS service team) so having established ones with workable limits in advance across multiple cloud providers would be table stakes for any competent spying organization.

[duxup]

I'm sure that applies to most every service as far as bad guys operating covertly.

I've no problem with AWS or anyone playing whack-a-mole and giving them the run around in the meantime ...