In the final stage of their operation, BlackTech attempts to exfiltrate valuable data, including intellectual property and confidential communications, signaling the culmination of their espionage activities. The DLP tool detected abnormal data transfer attempts towards an external IP address associated with known threat actors.