The attackers, with stolen credentials, attempted to access the corporate network from a compromised mobile device. This step indicates a sophisticated lateral movement attempt, aiming to escalate their access to sensitive corporate data.