Even in the fog of war - a tank is still visible

First day under cyberattack, watching microtik logs create generated dns addresses, alike watching antilopes in the savannah while our mates kilometers across desperately try and log in but forced out due to overflow
Managed active firewall rules w head of our small operation
Infected machine is strangled by us already, rn watching traffic through wireshark go2 our domain controller and be redirected to router

Monitoring it closely, still trying to find nature of traffic itself

Also 7 places lost wan connect, other dep fixing it, couple h should be ready

Feels like this