After establishing a foothold in the target networks, APT41 began exfiltrating sensitive data, highlighting the operation's true espionage objective amid the larger attack. The exfiltration was detected through anomalous data transfer patterns from internal servers to an external IP address.