### Overview
The attackers are actively moving laterally within the network, targeting critical systems essential for ceremony operations.

### Details
- **Techniques Used**: SMB protocol exploitation and credential dumping observed.
- **Targets**: Focus on database servers and event coordination systems.

### Insights
Their movement patterns suggest a high level of network knowledge, potentially indicating insider collaboration. The next phase may involve data exfiltration, aiming at sensitive information related to event operations and personnel.