DarkHotel APT group attempts to harvest credentials from a compromised device, aiming to move laterally and access additional systems within the network. The attack was detected through unusual login attempts from an external IP address using a compromised internal account.