## Overview
Lateral movement within the network allowed Sandworm to reach critical substations and ICS components.

### Techniques Used
- **Credential Harvesting**: Compromised credentials were used to navigate the network stealthily.
- **Remote Execution**: Tools like PsExec and WMIC were employed for remote execution and system manipulation.

### Mitigation Strategies
Strengthening network segmentation and implementing robust monitoring can help identify and halt lateral movements before critical systems are compromised.