Using stolen credentials, the attacker moves laterally within the network, targeting additional systems to widen their access and control. The attacker used RDP connections to access a critical server using the account j.doe.