Using harvested credentials, Maze moves laterally across the network, accessing multiple systems and escalating their control. Unusual network connections were detected from an internal host to multiple internal systems.