MSTIC has observed NICKEL actors using exploits against unpatched systems to compromise remote access services and appliances. MSTIC has also observed NICKEL perform frequent and scheduled data collection and exfiltration from victim networks