An unauthorized lateral movement was detected within the network. The attacker utilized compromised credentials to connect to multiple internal systems, potentially to identify and encrypt additional targets. This action follows the establishment of persistence and aims to maximize impact before initiating negotiations.