APT17 is utilizing harvested credentials to attempt lateral movement within the network. The objective is to access critical assets, thus deepening their infiltration. This activity involves the use of known malicious tools and compromised credentials, indicating an attempt to expand control over internal systems.