Using stolen credentials, the threat actors move laterally across the network, targeting critical systems and expanding their reach. The attacker accessed sensitive systems using harvested credentials.