Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
IP70.153.18.45HighIP36.94.34.18HighIP163.7.0.131HighIP43.157.198.137HighIP43.173.37.53HighIP38.60.179.31HighIP38.253.224.56HighIP43.173.6.125HighIP43.173.37.197HighIP138.252.92.117HighIP130.94.93.147HighIP72.61.140.138HighIP104.64.0.199HighIP43.157.240.245HighIP43.173.28.224HighIP147.139.168.67HighIP43.165.195.9HighIP43.165.197.228HighIP43.165.198.94HighIP43.165.197.71HighIP103.160.185.100HighIP103.148.197.54HighIP112.78.151.90HighIP43.157.198.200HighIP103.22.137.227HighDomainavianca.sxjgo.ccHighIP43.165.198.5HighIP43.165.197.116HighIP43.165.195.234HighIP43.165.198.224HighIP43.165.198.144HighIP103.87.16.26MediumIP45.198.224.125MediumIP36.66.209.66MediumIP103.168.147.235MediumIP222.124.158.12MediumIP103.16.117.92HighIP34.101.80.31HighIP103.168.190.98MediumIP45.198.224.231MediumIP14.102.84.191HighIP103.47.134.21MediumIP163.7.6.154MediumIP43.173.38.253HighIP36.69.157.49HighIP165.154.48.160MediumDomainsedowin.comMediumIP38.60.179.212HighIP203.153.216.182HighIP112.78.142.170High
…