## Overview

Following the detection of unauthorized credential access, it is crucial to understand the attackers' motives and methods for exfiltrating sensitive information.

## Observations

- **Credential Harvesting**: Attackers used the Pirpi backdoor to capture login credentials from memory.
- **Targeted Accounts**: Focus on administrative and high-privilege accounts.

## Next Stage

The attackers are likely preparing for large-scale data exfiltration using encrypted channels to avoid detection. Monitoring for unusual network activities is essential to mitigate further risks.