Their exploit is using E2C instances to tunnel/hide their traffic. Bethesda is apparently using E2C for some things, but the code running on the machine [which has been frozen/dumped and sent off already] was not all Bethesda code.