They See Me Roaming: Following APT29 by Taking a Deeper Look at Windows Credential Roaming | Mandiant

https://www.mandiant.com/resources/blog/apt29-windows-credential-roaming

https://twitter.com/home/status/1590162113926156290

https://twitter.com/home/status/1590297647927140353

https://twitter.com/home/status/1590312064869756928

https://twitter.com/home/status/1590312352762982402

https://twitter.com/home/status/1590321728785633280

https://twitter.com/home/status/1590339932425715712

https://twitter.com/home/status/1590352676893913093

https://twitter.com/home/status/1590354824696303618

https://twitter.com/home/status/1590412561198903296