An unauthorized data exfiltration attempt was detected involving the transfer of sensitive files to an external IP address. The threat actor, identified by the use of known malware hashes and suspicious IP addresses, attempted to leverage their access to exfiltrate critical data before initiating a destructive attack.