During the final stage of the attack, APT17 attempted to exfiltrate sensitive data to an external server. This action was detected and blocked by the Data Loss Prevention System. The attack leveraged a compromised internal host to send data to a known malicious IP address.