In a final move, data is exfiltrated, possibly containing sensitive information that can be leveraged in future operations or sold on the black market. The threat actor utilized a compromised internal server to transmit sensitive documents to an external IP address.