A group of incident responders discovered that an organization had been breached for at least half a decade when they informed the organization about the earliest evidence found. Active lateral movements, logging in, and updating tools all contributed to their detection of the breach.