The final step in APT3's campaign attempts to exfiltrate sensitive data through encrypted channels, aiming to avoid detection. The attack was detected when a large volume of data was being sent from an internal server to an unfamiliar external IP address using HTTPS. The data transfer was flagged by DLP systems due to the encrypted channel and the large volume of data.