An attacker used stolen credentials to move laterally into the corporate cloud environment from a compromised home machine. The attacker targeted critical infrastructure and attempted to access sensitive data.