With a foothold established, APT17 attempts to exfiltrate sensitive data to their command and control servers, but vigilant monitoring raises an alert, providing an opportunity to thwart the data theft.