And once they've broken in, they execute PowerShell commands and hoover up data about the internal network environment, ...