# Lateral Movement via Hijacked Credentials

## Summary
Utilizing hijacked credentials, the adversaries are expanding their presence across the network. This lateral movement allows them to access additional systems and data.

## Details
- **Credential Theft**: Credentials were harvested using keyloggers and memory scraping techniques.
- **Access Points**: Compromised accounts are used to access shared drives, email servers, and other critical systems.
- **Objective**: Broader network infiltration to locate valuable intelligence.

## Next Steps
The adversaries will likely use hijacked satellite links to exfiltrate sensitive data, masking their C2 locations and avoiding detection.

## Recommendations
- Implement multi-factor authentication (MFA) to reduce the risk of credential misuse.
- Monitor for unusual login patterns and access attempts to critical systems.