An advanced persistent threat actor, identified as part of the Lazarus Group, has been observed harvesting credentials from an infected device to secure a foothold for lateral movement within the organization's digital environment. This tactic is indicative of their strategy to maintain long-term access and prepare for financial theft or destructive operations.