Dissecting the Golden SAML Attack Used by Attackers Exploiting the SUNBURST Backdoor