Kimsuky leveraged compromised credentials to move laterally within the network, targeting shared drives to access sensitive data. The operation utilized suspicious network activity originating from an external IP address, accessing multiple shared drives on the 192.168.x.x network.