Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
https://wws.cert-ist.com/private/fr/IocAttack_details?format=html&objectType=ATK&ref=CERT-IST/ATK-2016-066
Russia