Attacker used stolen IT credentials for entry, gained persistence.