Utilizing harvested credentials, the attackers moved laterally within the network, targeting additional systems in the nuclear and energy sectors. This activity is consistent with advanced persistent threats known for targeting critical infrastructure.