## Overview
Following the establishment of persistence, anomalous lateral movement activity was detected, indicating the attackers are exploring and exploiting additional systems within the network.

## Technical Details
- **Movement Pattern**: The attackers utilized existing network shares and admin credentials to access other critical systems.
- **Tools Used**: Remote Desktop Protocol (RDP) and SMB protocol were primarily used for lateral movement.

## Implications
This lateral movement could lead to further system compromises, increasing the risk of widespread impact. Immediate network segmentation and enhanced monitoring are recommended to mitigate further propagation.