Utilizing credentials harvested from compromised systems, the attackers move laterally across the network to access sensitive internal systems and gather intelligence. Detected unusual login activity from a potentially compromised external IP address.