# Credential Harvesting Activities Detected

## Overview
With persistence established, Lyceum is actively harvesting credentials to move laterally within the network.

## Key Findings
- **Credential Dumping Tools**: Use of Mimikatz to extract passwords and hashes.
- **Targeted Accounts**: High-value accounts with privileged access are being compromised.
- **Network Traffic**: Increased anomalous traffic between critical nodes.

## Next Steps
Prepare for potential data exfiltration by monitoring data staging activities.