The intrusion began with the delivery of an ISO file that contained an LNK and a DLL.
The threat actors leveraged BumbleBee to load a Meterpreter agent and Cobalt Strike Beacons.
They then performed reconnaissance, used two different UAC bypass techniques, dumped credentials, escalated privileges using a ZeroLogon exploit, and moved laterally through the environment.