APT1 uses harvested credentials to move laterally within the network, searching for systems containing valuable data. Network traffic analysis detected unusual authentication patterns involving known malicious IP addresses and suspicious file transfers.