During the past year, an organization’s HR department has accessed data from its legal department on the final day of every month to produce a monthly activity report. An engineer is investigating suspicious activity flagged by a threat-intelligence platform: an authorized HR user has accessed legal data every day for the past week. The engineer retrieved network data from the legal department’s shared folders and found data dumps larger than average. Which threat actor is indicated by these artifacts?