After gaining access, the attackers deployed a suspicious script to execute a ransomware payload, aiming to encrypt critical business data and demand a ransom. The script was detected running on a critical server.