In the final phase of their operation, APT1 successfully exfiltrated sensitive intellectual property using encrypted channels to avoid detection. The malicious traffic was identified originating from an internal host and directed towards a known malicious IP address.