### Lateral Movement Detection

The adversary utilized Remote Desktop Protocol (RDP) to move laterally within the network. This was facilitated by previously compromised credentials.

### Immediate Actions

1. **Credential Review:** Reset passwords for all affected accounts and enforce MFA.
2. **RDP Restrictions:** Limit RDP access to only essential personnel and monitor for unauthorized attempts.

### Preparing for Data Exfiltration

As exfiltration is likely the next stage, enhance monitoring of outbound network traffic and inspect large data transfers for legitimacy. Employ DLP solutions to prevent unauthorized data transfers.