## Overview
APT38 is activating its mule network to facilitate the coordinated withdrawal of funds from compromised ATMs. This stage involves lateral movement within the network to access ATM management systems.

## Technical Details
- **Lateral Movement Technique:** Credential dumping and pass-the-hash attacks were utilized to move between systems.
- **Mule Network:** Individuals across multiple regions in Africa and Asia have been identified as part of the network.
- **ATM Targets:** Specific ATMs were preselected based on cash availability and location.

## Recommendations
- **Immediate Action:** Alert local law enforcement agencies and financial institutions to monitor and secure ATMs.
- **Monitoring:** Deploy network segmentation to limit unauthorized lateral movement.

## Next Steps
Prepare for the exfiltration of stolen funds as APT38 finalizes its cash-out operations.