The attackers, having established persistence on the network, are attempting lateral movement targeting Triconex SIS controllers. This step involves the use of known malicious IPs and tools to gain access to critical safety systems.