1742
Once the hacking group has infiltrated a network , it conducts reconnaissance to ensure legitimate credentials have been gained , before deploying tools such as mimikatz or PwDump to steal additional credentials , administration credentials , and data from infected MSPs .
 ( data breach: have been gained,  legitimate credentials: compromised data, the hacking group: attacker) 
Locate the role in the text that participated in the event based on the event type and return it in the event list. 
 Option: Event type: phishing, data breach, ransom, discover vulnerability, patch vulnerability, Arguments type: vulnerable system, capabilities, vulnerability, number of victim, issues addressed, compromised data, damage amount, common vulnerabilities and exposures, victim, patch number, number of data, tool, discoverer, time, purpose, place, payment method, releaser, vulnerable system version, attacker, supported platform, patch, price, vulnerable system owner, trusted entity, attack pattern. 
Text: {0} 
Answer:
 ( data breach: have been gained,  legitimate credentials: compromised data, the hacking group: attacker) 