The threat used valid accounts against remote services: Cloud-based applications utilizing federated authentication protocols. Our incident responders analysed the credentials used by the adversary and the traces of the intrusion in log files. They uncovered an obvious overlap in the credentials used by this threat and the presence of those same accounts in previously breached databases. Besides that, the traces in log files showed more than usual login attempts with a username formatted as email address, e.g. username&gt;@&lt;email domain&gt;. While usernames for legitimate logins at the victim’s network were generally formatted like &lt;domain&gt;\&lt;username&gt;. And attempted logins came from a relative small set of IP-addresses