One intrusion, two cyberattackers: Uncovering parallel threat activity