I am not following your borderline racist comment about a name. Why do you assume stolen credentials? Low hanging fruit could be the entry point, but advanced attacks are common with state actors so this is highly assumptive and brings nothing to the discussion.