Leveraging their foothold, the attackers moved laterally across the network, targeting and compromising additional substations. The operation was identified through suspicious network traffic between internal systems and command and control indicators.