The attackers are utilizing their foothold to move laterally across the network, specifically targeting VMware ESXi servers to expand their access within the virtual environment. This is a sophisticated operation involving advanced techniques.