The attackers exploited stolen credentials to move laterally within the network, targeting critical systems within the telecommunications infrastructure. This activity indicates a sophisticated actor with a detailed understanding of the network topology.