Sophos researchers believe that the first incident started on 10 August 2021, when attackers, possibly initial access brokers, used a ProxyShell exploit to gain access to the network and establish a foothold on the compromised server. The Sophos investigation showed that almost four months passed before Karma appeared on 30 November 2021, and exfiltrated more than 52 gigabytes of data to the cloud.