A full disk imaging was mitigated for further analysis and lateral movement. The timeline suggests the threat actor had access for business hours before malware alert. By remediate the firewall,...