They See Me Roaming: Following APT29 by Taking a Deeper Look at Windows Credential Roaming

https://www.mandiant.com/resources/blog/apt29-windows-credential-roaming

…