The attackers have initiated data exfiltration by encrypting sensitive military data and transferring it through a secure TLS channel to an external server. The data was gathered using a deployed VBScript backdoor, enabling discreet exfiltration.