In an advanced attempt to evade detection, the threat actor Hafnium executed commands to remove event logs and other indicators of compromise from the system. This action is aimed at erasing traces of their presence and prolonging unauthorized access.