In the final step of the operation, Earth Lusca exfiltrated sensitive governmental data to an external server. The data was transmitted via an unauthorized file transfer to a known malicious IP address.