Network traffic analysis detected suspicious lateral movement activity. The attackers used credential dumping techniques to gain access to additional systems within the HSE network, targeting critical systems managing the COVID-19 vaccination program.