Exploiting harvested credentials, the attackers gained access to internal servers using lateral movement techniques. This positions them to manipulate ATM operations and extract financial data. The operation was detected via unusual login patterns and unauthorized access to critical systems.