An attacker was detected moving laterally within the internal network by exploiting compromised credentials. The attacker was observed accessing multiple internal systems, suggesting an attempt to identify sensitive data and further vulnerabilities.