New evidence suggests the recent attack targeting Stryker involved compromised credentials obtained via infostealer malware.