Utilizing stolen credentials, the attackers move laterally across the network, accessing additional sensitive systems in search of valuable data. The detected traffic indicates unauthorized connections to multiple internal systems.