### Context
Persistence mechanisms have been established, and now there's evidence of lateral movement within the network.

### Details
APT27 is known for leveraging stolen credentials to move laterally across networks. This often involves accessing shared drives, using remote desktop protocols, or exploiting vulnerabilities in unpatched systems to spread malware and access sensitive data.

### Next Steps
Focus on identifying potential data exfiltration pathways. Implement network segmentation and monitor outbound traffic for anomalies, especially from unexpected endpoints.