APT1 executed the final phase of their operation by encrypting and exfiltrating sensitive guest records, including passport numbers, through a masked data transfer to avoid detection. The transfer was facilitated over a compromised internal server using encrypted channels.