Using stolen credentials, an attacker has moved laterally within the network, attempting to access federal wiretap systems. The attack was detected at step 4, where unauthorized login attempts were observed from an internal host to a sensitive wiretap server.