Deep Panda identified conducting internal reconnaissance to map network and locate critical databases. Movement detected from 10.0.0.45 to 192.168.1.100, targeting database server containing sensitive patient records.