Managed Defense, utilizing FireEye Endpoint Security technology, detected and responded to the threat activity identified within the customer’s environment. The subsequent investigation revealed FIN6 was in the initial phase of an intrusion using stolen credentials, Cobalt Strike, Metasploit, and publicly available tools such as Adfind and 7-Zip to conduct internal reconnaissance, compress data, and aid their overall mission.