Adversaries may use Valid Accounts to log into a service specifically designed to accept remote connections, such as RDP, SSH, or SMB.
After initial compromise, ransomware operators often use RDP to move laterally within networks, deploying ransomware to multiple systems.