In the final stage of their operation, attackers exfiltrate valuable ICS configuration and operational data using encrypted channels. The data is intended for future intelligence and potential sabotage.