Initial triage indicates that 001 systems were compromised through misconfigured services. The timeline suggests the threat actor had access for previous quarter before suspicious outbound...

I agree with malware_hunter's assessment regarding incident response.