Attackers are attempting to expand their foothold by moving laterally within the network, targeting sensitive data stores and critical systems. Unauthorized access was detected from an external IP to multiple internal systems.