Please help to identify the following description belonging to which technique in MITRE and the corresponding tactics: FIN10 has used stolen credentials to connect remotely to victim networks using VPNs protected with only a single factor.