Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
2 IOCs with confidence of 50% or more associated with ZW