Proofpoint said this is the first time the threat actor has been seen using LLM-generated PowerShell scripts