The attackers exploit weak integration protocols within TNT's legacy systems to move laterally, exacerbating the damage and causing widespread operational disruption. The compromised credentials were used to access a legacy system and execute a known malicious binary associated with the Sandworm group.