In that, phishing for malware delivery is getting harder so some gangs try unsecured cloud/onprem assets for initial access. Phishing levels have not changed overall from my perspective but how targeted attacks happen seems to be tilting slightly to other initial access tactics.