Groundbait employs credential dumping techniques to harvest login information, allowing them to move laterally across the network and expand their surveillance scope. In this instance, a suspicious process was detected accessing LSASS memory on a domain controller.