The attacker uses credential stuffing techniques to maintain persistent access, leveraging previously breached credentials to avoid detection. Multiple login attempts from a known malicious IP address were detected targeting several user accounts within the network.