If the management plane has been breached, you should confirm the templates/configurations for your infrastructure or applications have not also been compromise...