value:  Through reading the extracted emails, threat actors identified that fund transfers were originating in the accounting department by person A and approved by manager B. 
name: Gather Victim Org Information: Identify Roles