In the final stage of their attack cycle, attackers attempted to exfiltrate sensitive data from the target network. The data was intended to be used as leverage for ransom, threatening its release if demands were not met. The DLP system detected unusual outbound data movement, aligning with known exfiltration techniques.