Following successful phishing, APT17 executed a custom payload designed to bypass traditional antivirus solutions and establish control over the compromised system. The payload was detected executing on a Windows endpoint, aiming to establish a foothold within the network.