APT40 utilized encrypted channels to transfer the stolen sonar technology schematics to external servers, completing their data theft operation. The data exfiltration was detected by DLP systems monitoring outgoing traffic. The transfer was executed using the file 'sonar_tech_designs.zip' over an encrypted connection to a known malicious IP address.