Anomalous data transfer activities are detected, indicating potential exfiltration of sensitive information to external servers controlled by the attackers. The data transfer volume and destination IPs suggest a sophisticated exfiltration attempt.