Often attacks like this involve first getting on the VPN (leaked creds, a n-day on a web-accessible endpoint, etc) then running wild on the internal services that everyone assumes are safe.
"I won't lock the door coz attackers might be able to bring battering ram"
"I won't lock the door coz attackers might be able to bring battering ram"