Five years of access with no exfiltration objective. Pre-positioning breaks every response method that starts by asking what the intruder wanted.
Every playbook assumes an event. Pre-positioning has none — the adversary is deliberately behaving like an administrator.
The only file here where the recorded harm is entirely prospective. The point was to be there later.