Following successful access, the attackers executed the ransomware to encrypt critical municipal data, escalating the attack. The ransomware payload was identified on the compromised systems, initiating encryption of sensitive files.