An attacker has compromised the Database server. An Administrator is RDPing into the Jump box, into the Domain Controller, into a File Server and finally the Database Server. Within any part of the chain, the attacker can unleash the RDPInception attack and it will theoretically spiral out to obtain a shell on each of the servers in the chain the next time the administrator logs into each machine. The attacker only needs to launch the RDPInception attack on DB001 at this point and the rest will take care of itself and unravel.