### Overview
Reconnaissance has led to data collection activities, likely preparing for exfiltration.

### Details
- **Activity**: Access and aggregation of sensitive data.
- **Objective**: Prepare data for exfiltration.
- **Indicators**: Large data access events, unusual file movements.

### Next Steps
Expect attempts to exfiltrate data via HTTP POST or other channels. Enhance monitoring on outbound traffic.