The attackers use harvested credentials to move laterally across the network, seeking sensitive information within government databases. Malicious activity involving external IP 203.0.113.45 attempting to authenticate using compromised credentials was detected.