### Overview
Post-phishing campaign, the threat actors focused on establishing persistence by dumping compromised credentials.

### Details
- **Tools Used:** Utilized Mimikatz and other credential dumping tools.
- **Targets:** Key personnel with elevated privileges.

### Indicators of Compromise (IoCs)
- Unauthorized access to credential stores.
- Sudden, unexplained privilege escalations.

### Recommendations
- Regularly monitor for anomalous login attempts.
- Enforce password changes for affected accounts.