APT3 exploited a Windows zero-day vulnerability to move laterally within the network, targeting internal systems. The attack was detected through abnormal network traffic originating from an external IP address known for malicious activities.