Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
IP133.18.107.191HighIP31.223.184.166HighIP210.140.10.24HighIP40.74.72.100HighIP20.48.114.7HighIP45.114.130.4HighIP202.144.192.47MediumIP23.128.228.6MediumIP104.234.140.13HighIP104.234.140.28HighIP104.234.140.30HighIP104.234.140.18HighIP64.176.34.176HighIP166.0.22.206HighIP20.89.67.216HighIP149.104.78.139HighIP43.133.164.200HighIP139.180.192.248HighIP139.180.198.145HighIP43.133.165.151HighIP130.94.67.107HighIP154.213.182.181HighIP38.54.88.188HighIP153.142.13.183HighIP18.179.34.241HighIP176.126.114.42HighIP45.249.89.172HighIP35.72.209.50HighIP45.32.29.179HighIP52.246.183.133HighIP52.196.90.106HighIP23.27.52.106HighIP139.162.113.221HighIP103.53.80.201HighIP130.94.66.253HighIP18.176.225.124HighIP134.122.140.185HighIP202.78.167.55HighIP177.3.92.247HighIP16.208.130.160HighIP134.122.132.3HighIP152.32.202.240HighIP134.122.132.35HighIP154.40.62.125HighIP43.167.177.224HighIP52.197.194.156HighIP134.122.130.186HighIP57.182.163.105HighIP135.84.210.197HighIP3.113.147.16High
…