### Overview
To mask their activities, the attackers tampered with logs to remove traces of their movements and actions.

### Details
- **Tactics:**
  - Altered or deleted logs from critical systems.
  - Used scripts to automate log-cleaning processes.

### Indicators of Compromise (IoCs)
- Inconsistencies in log files.
- Missing logs from key timeframes.

### Recommendations
- Implement immutable logging solutions.
- Regularly backup logs to secure, offsite locations.