Using harvested credentials, the attackers conducted reconnaissance to map the network and identify high-value targets for data exfiltration. The operation involved suspicious SMB traffic from an internal IP to multiple endpoints in the network.