Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
IP102.152.29.94HighIP196.177.214.142HighIP196.177.45.36HighIP197.10.242.54MediumIP41.231.36.137MediumIP197.5.145.150MediumIP197.5.145.102MediumIP167.114.39.217MediumIP102.156.183.175MediumIP193.95.31.162Medium