The RAT begins harvesting credentials, allowing the attackers to move laterally across the network and compromise additional systems. Observed network traffic indicates the use of stolen credentials to access multiple internal systems.