The attackers initiated a network scan from an external IP address, attempting to map out the telecom infrastructure. This is part of a lateral movement strategy to identify high-value targets within the network.