Network Lateral Movement

And we're also starting to see agents interacting with one another.

Does that create something analogous or lateral movement in traditional cybersecurity where one compromise agent can become a pathway to like a much larger system compromise since they're all connected essentially, right? Yeah.

Yeah, yeah.

So basically, yes, late film moment is a very useful analogy here.

That is one of the major reasons.

The second thing was that attackers tried to access to AD servers, extract information about the AD servers, and from those information, they utilize it to further make more lateral movement.

How we got to know? There are a lot of indicators that we found.

I will be showing some screenshots of some event ideas which played a very prominent role for us to detect these kind of activities.

We'll be right back.

A component of this was their lateral movement.

Can you walk us through what they were doing there?

Yeah, so what is interesting actually with this group Hyadina, they're very, since the start, even since they, I suppose, first came out as Monster and then when they were Beast as well and now with Goddamn, they're very focused on deploying a lot of password seeding, potential harvesting tools.

So they did that.

They downloaded a lot of these tools and then they had a little gap of activity probably while They were sort of, I suppose, coordinating all these credentials.

And then Lateral Movement began across the network at that point.

And they used, again, using legitimate tools as well for this activity.