Large volumes of data are prepared for final exfiltration, marking the conclusion of the attack operation. Data transfer detected from internal network to an external IP linked with known malicious activity.