The go-to tool in many scenarios like this today are remote access trojans, often referred to as a RATs. A RAT consolidates a number of tools into one package. Many RATs include the ability to scrape saved and cached passwords, and once the usernames and passwords are in hand, the attacker can attempt to log into the shared server. To move laterally, they may want to try searching for login credentials on the system theyve already compromised.”]
Source: https://blogs.cisco.com/security/remote-access-trojans