IndigoZebra carried out the final stage of their operation, exfiltrating sensitive data using encrypted C2 channels. This activity was detected by our DLP tools, indicating the use of encrypted traffic to an external IP associated with known malicious activities.