It wouldn't be one machine. The initial incursion would have been used to leverage other local attacks. Then targeting domain controllers and admin accounts.

It wouldn't be one machine. The initial incursion would have been used to leverage other local attacks. Then targeting domain controllers and admin accounts. Probably also reading email; one possible way of finding it needed to get at 5 of 9 keys to unlock.