criminals used compromised credentials to leverage a remote tool that was set up without MFA protection.