Observed lateral movement activity consistent with Hafnium APT group tactics. A compromised internal host was used to authenticate to multiple devices using stolen credentials. Data exfiltration attempts were detected targeting files typically associated with sensitive defense information.