During step 4 of the operation, the Lazarus Group has moved laterally within the network, identifying critical systems for further exploitation. This activity was detected through internal server logs showing unauthorized access attempts and suspicious file transfers.