### Summary
APT28 is leveraging stolen credentials to move laterally within the network.

### Details
- **Credential Harvesting**: Credentials were harvested from compromised machines via the X-Agent implant.
- **Lateral Movement Tactics**: Techniques include Pass-the-Hash and Pass-the-Ticket to access additional systems.

### Recommendations
- Reset compromised credentials and enforce multi-factor authentication.
- Regularly audit user access rights and monitor for unauthorized access attempts.