## Context
Post credential harvesting, the attackers utilized the compromised credentials to move laterally across the internal network of the cryptocurrency exchanges.

## Insight
Using legitimate credentials, the threat actors accessed additional systems and expanded their footprint. This movement was aimed at identifying systems with higher privileges or direct access to cryptocurrency wallets.

## Mitigation
Immediate containment measures should be enacted, including isolating affected systems, revoking all compromised credentials, and conducting a thorough investigation to map the extent of the penetration.