## Overview
After establishing persistence, APT36 often conducts lateral movement to explore the internal network, aiming to discover and compromise additional assets.

## Techniques Observed
- **Credential Dumping:** Uses tools to harvest credentials and access other systems.
- **Network Scanning:** Identifies live hosts, open ports, and vulnerable services.
- **SMB/Windows Admin Shares:** Utilizes existing network shares to move laterally.

## Next Steps
Focus on monitoring for any signs of data exfiltration as APT36 may attempt to collect and send sensitive information outside the network.