Hafnium executed a series of reconnaissance commands to map the network and locate key data repositories. This activity is indicative of an advanced attack with the objective of identifying sensitive data and valuable assets within the target organization.