Using the harvested credentials and specialized administrative tools, the attackers move laterally across the network. They target systems responsible for managing ATM withdrawal limits and SWIFT transactions, setting the stage for unauthorized financial operations.