With persistence established, MuddyWater begins lateral movement, exploiting vulnerabilities to reach critical network segments. The attacker used stolen credentials to attempt access to sensitive telecommunications infrastructure.