The attackers found another slow db query to exploit, so had to put some temporary measures in place.

Will post more details later!

This time they actually took down the instance for several hours.