Unravelling a Mimikatz campaign

A researcher discovered an open DigitalOcean staging server hosting Mimikatz binaries and a set of 78 ".creds" filename artifacts suggesting 78 credential-dumping events between 22 July and 7 August 2022; most targeted IPs were in Japan (many on Maxihost), activity clustered by time-of-day, and the author assesses a likely compromise of multiple systems at a Japanese entity and that the operator may be in a UTC+4 timezone.