### Context
The detection of unexpected RDP sessions suggests an ongoing lateral movement effort by the attacker within the network.

### Findings
- **RDP Activity**: Multiple unauthorized RDP sessions were initiated, likely to access sensitive systems and further compromise the infrastructure.
- **Patterns**: The sessions were conducted using compromised credentials, indicating the threat actor's success in credential theft.

### Recommendations
- **Access Controls**: Enhance RDP access controls and enforce multi-factor authentication for remote access.
- **Surveillance**: Implement continuous monitoring of RDP sessions and alert on any deviations from normal patterns.

### Next Steps
Remain alert for potential exfiltration attempts, as attackers may leverage newly gained access to exfiltrate data through encrypted channels.