According to FinTelegram, the attackers impersonated senior executives and advisers using synthetic voice and video, convincing internal staff to authorise transfers that would normally have required multiple sign-offs.