FIN7 has moved laterally within the network using compromised credentials to access the payment processing network. The movement was detected through unusual network activity and the presence of known malicious IP addresses and file hashes.