Tyrese, a cybersecurity analyst, is performing an audit of user accounts when he discovers a handful of accounts that do not appear to represent actual employees at his organization. As he continues to investigate, he finds the accounts were created around four months ago and only connect to resources from outside the network. Which of the following might he have discovered?

Zero$-$day attack

Ransomware

DDoS

APT