Chris Morales, head of security analytics at Vectra, told Threatpost that the attack appears to follow the same sequence of events that occurs in almost every major breach including Marriott and Equifax: Command and control, reconnaissance, lateral movement and data exfiltration.