The threat actor has moved laterally to access additional public databases, attempting to expand their data collection efforts. The observed activity involves accessing internal resources using compromised credentials and pivoting to external databases.