The attacker utilizes a web shell to scan internal networks, focusing on critical infrastructure such as domain controllers. Unusual network traffic from an external IP was detected accessing internal servers via a VPN, indicative of lateral movement attempts.