In the final phase of the operation, unusual outbound network traffic was detected originating from an internal host (192.168.1.105) towards an external IP (203.0.113.55). The data packets identified were large and encrypted, suggesting potential exfiltration of sensitive data. The files transferred included classified documents under the guise of normal traffic. The external IP is associated with known APT group infrastructure.