Once the threat actor mapped the network and obtained credentials (through net use), they began to move laterally. The threat actor relied on WMI and PsExec to move laterally and install their tools across multiple assets