• Backup first: a modified Veeam-Get-Creds.ps1 read and DPAPI-decrypted stored credentials on three Veeam servers via Impacket-style remote execution; a scheduled task named VEEAMPROBE was created on a backup server.
• Credentials: reg save of SECURITY and SYSTEM hives; Mimikatz renamed sysmon64.exe, svcstat.exe and random .tmp.exe; a comsvcs.dll MiniDump of LSASS; Chrome Login Data copied; portable Python 3.11 running crackw.py from C:\Windows\Temp.
• Persistence: domain admins library and svc_bkpmon, created by two different routes.
• Unusual exfil: files staged as base64 registry values (HKLM\SOFTWARE\FIN001…FIN040, FINCOUNT, HKLM\SOFTWARE\VC31), zipped and POSTed to rcv.aspx on the unmanaged host, with alive HH:mm heartbeats.
• Spreading: dnscmd /zoneadd … /dsforwarder then netdom trust … /add /twoway joined three separate AD domains; grant_lib.ps1 pushed by scheduled task to about 40 machines; av_remove.ps1/av_remove2.ps1 tried to strip Sophos and Bitdefender (blocked by anti-tamper).
• Impact: host.exe -k <id> -s 15 with wbadmin delete systemstatebackup -keepVersions:0 -quiet.
• Model-style artifacts worth alerting on: files and tasks named da_proof.txt, psexec-ok, TASK-OK, test123, step1.txt…step3.txt; output like ===TRUSTS=== or == CONNECTIVITY ==; 2>/dev/null inside cmd.exe lines; Impacket wmiexec output files __<timestamp> in ADMIN$.

Bitdefender publishes the full IoC set on its GitHub IoC repository. Its main point for defenders: an agentic loop makes an intrusion noisy and repetitive, not stealthy, so prevention controls that block an action the first time beat detections that rely on speed.