### Overview
The final stage of the intrusion was marked by the exfiltration of call detail records (CDRs), confirming the adversary's objective.

### Exfiltration Details
- **Data Transfer**: Significant outbound data transfers were recorded, consistent with the volume of CDRs.
- **Destination IP**: Transfers were directed towards an external server that has been linked to previous Gallium APT activities.

### Recommendations
- **Data Loss Prevention**: Implement DLP solutions to monitor and block unauthorized data transfers.
- **Incident Response**: Initiate a full incident response procedure to assess the extent of the breach and remediate affected systems.