## Movement Patterns
Unauthorized lateral movement has been detected, suggesting an expansion of the attack surface by FIN6 operatives.

## Indicators of Compromise
- **Credential Harvesting**: Attempts to access additional systems using compromised credentials.
- **Network Scanning**: Scans targeting lateral movement pathways.
- **Unauthorized Access**: Attempts to access HR and financial systems.

## Containment Strategies
- Implement network segmentation to restrict unauthorized access.
- Reset credentials for all potentially compromised accounts.

## Next Steps
Prepare for potential data exfiltration attempts, focusing particularly on sensitive financial data.