A lateral movement within the cloud infrastructure was detected. The attacker, leveraging existing access, targeted additional diplomatic cloud accounts. Indicators of compromise involved suspicious internal IP communications and unauthorized access from a known malicious IP.