The attackers use escalated privileges to move laterally within the network, targeting systems that control pipeline operations. Network logs indicate unauthorized login attempts to admin accounts from suspicious external IPs.