Compromised credentials were used by the attacker to perform lateral movement within the network. The attacker, associated with the Whitefly group, utilized stolen credentials to access multiple systems, potentially exfiltrating sensitive data.