Indicators of credential dumping were identified, suggesting lateral movement within the network, targeting validator nodes. This activity aligns with known tactics and techniques of the Lazarus Group.