### Overview
Following the initial phishing success, APT1 deployed a sophisticated Remote Access Trojan (RAT) to execute commands and maintain control over compromised systems.

### Key Findings
- **RAT Characteristics**: The RAT employed is capable of evading detection, utilizing encryption to mask its activities.
- **Command and Control (C2)**: Communication with external command servers was established, indicating preparation for sustained network presence.
- **Execution Pathways**: The malware was executed via compromised user credentials, minimizing detection risk.

### Next Steps
Investigate persistence mechanisms to understand how APT1 maintains long-term access and control over compromised systems.