An advanced attack has been identified where the attackers have deployed a credential dumping tool to extract passwords from memory, potentially to escalate privileges within the network. The activity was traced back to a specific host within the internal network, and network traffic analysis confirmed communication with a known malicious IP.