summary: “Maintaining and expanding access after initial compromise through lateral movement, persistence mechanisms, and data exfiltration.”