Upon gaining access, the attackers executed the Sodinokibi ransomware, encrypting key systems to disrupt operations and increase the urgency of the ransom demand. The ransomware was executed on a critical server, leading to widespread encryption of important files.