Detection of the a P T

The security team goes back to studying the a p t to collect even more data. The forensic team feels confident enough that they've collected enough information and can remove it from the network. But all of a sudden, the activity from the hacking group stopped. We weren't seeing any movement. A which usually means that they've either succeeded in what they came to do or in something else.