The threat actor leverages compromised credentials to move laterally within the network, expanding their reach to additional systems of interest. Detected suspicious network activity indicating lateral movement from an internal host to another internal host using compromised credentials.