
From there on it took only uh three weeks uh for the customer to realize whoops I think we forgot to pass that points. Uh so that's where we came in and there were if you boil it down about 80 unique exploit payloads that we saw. Then we had a pretty popular one where they dumped the internal MySQL databases um for the credentials for example of the active directory and LDUP users um which also contains the office or Microsoft 365 credentials so you could take over arbitrary accounts. Um, we also saw some trusty loader payloads.