"The threat actor executed ipconfig /all to gather network configuration details. Shortly after, we observed network scanning behavior and brute-force attacks across the 10.xx.xx.0/24 subnet.

Targeted services included SSH, RDP, MySQL, MSSQL, FTP, and SMB."

1/3