In the final phase of the attack, the threat actors delivered a ransom note to the victim's email, demanding $51,000 in Bitcoin. The attackers used compromised email accounts to send the note and negotiate payment terms, while the actual recovery costs spiraled beyond the ransom demand.