During the investigation, it was discovered that the attackers moved laterally across the network, infecting numerous systems with ransomware. This movement was likely enabled by exploiting credentials of a compromised user account, spreading to multiple internal systems to maximize the attack's impact.