This was not a case of stolen credentials, but rather of vulnerability exploitation.
My homelab actually pays off now.