Anomalous RDP connection detected from a known malicious IP address using stolen credentials. This activity matches the lateral movement tactics commonly associated with the REvil group, indicating an attempt to expand access within the network.