The attackers leverage stolen credentials to move laterally across the network, seeking to compromise additional hosts and expand their control. Anomalous internal traffic patterns and unauthorized access attempts have been detected.