It actors look for and use VPN profiles during an operation to access the network using external VPN services. It has also obtained OWA account credentials during intrusions that it subsequently used to attempt to regain access when evicted from a victim network.