### Context
Following the detection of lateral movement, suspicious data exfiltration activities have been observed.

### Details
APT27 typically uses encrypted channels to exfiltrate data, making detection challenging. Common methods include using HTTPS or DNS tunneling to obscure data transfers.

### Mitigation
Enhance data loss prevention (DLP) measures and scrutinize outbound traffic patterns. Deploy SSL/TLS inspection capabilities and monitor DNS requests for anomalies. Immediate action is required to prevent further data loss and mitigate the impact.