With persistence established, the attacker is now exploring the internal network, attempting to access critical systems and harvest sensitive data. The attacker used compromised credentials to access a sensitive server and attempted to move laterally to other systems.