### Background
With persistent access achieved, attackers are now moving laterally within Facebook's network using compromised accounts.

### Key Findings
- **Account Compromise**: Analysis shows coordinated efforts to access privileged accounts, potentially targeting administrative or high-profile user data.
- **Internal Network Mapping**: Attackers are using compromised accounts to reconnoiter the internal network, searching for valuable data or vulnerable systems.
- **Escalation Attempts**: There are signs of attempts to escalate privileges within the network environment.

### Recommendations
- Conduct a full audit of account access logs to identify unusual access patterns.
- Implement stricter access controls for sensitive internal resources.

### Next Steps
Prepare for potential data exfiltration activities, as attackers may be positioning themselves to extract large volumes of user data.