A SOC team has confirmed a malware infection on several endpoints. They have already isolated the affected hosts from the network and preserved forensic images. The team now needs to remove the malicious files, delete attacker-created accounts, and close the vulnerabilities the attacker exploited before restoring systems to production. According to the NIST incident response workflow, which phase are they entering?