The attacker used stolen credentials to move laterally across the network, probing for systems hosting geological data repositories. The lateral movement was detected from internal IP 192.168.1.15 to 192.168.1.20 using compromised credentials of user 'j.doe'.