### Summary
KeyBoy's lateral movement within networks often exploits Remote Desktop Protocol (RDP) to access additional systems.

### Operational Details
- **RDP Exploitation:**
  - Use of stolen credentials or brute-force attacks to gain RDP access.
  - Deployment of additional malicious tools on new hosts.

- **Network Traffic Anomalies:**
  - Unusual RDP session activity outside normal business hours.
  - Spike in network traffic correlated with RDP connections.

### Defensive Measures
- **RDP Hardening:**
  - Enforce strong, complex passwords and multi-factor authentication.
  - Limit RDP access to necessary personnel and known IP addresses.