The attackers previously exploited vulnerabilities or used stolen credentials for initial access.