Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
IP37.211.0.110MediumIP103.14.209.251MediumIP176.202.31.31MediumIP34.18.165.179HighIP95.181.234.15HighIP95.181.234.25HighIP95.181.234.12HighIP37.186.52.22MediumIP80.76.160.21MediumIP80.76.163.187Low