Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
Ransomware, trojans, stealers, RATs, loaders, and backdoors with associated IOC signatures