Using harvested credentials, the attacker attempts to move laterally across the network to identify valuable targets. The activity was detected through unusual network traffic patterns originating from an internal system.