The final stage of the operation involves exfiltrating sensitive data, including financial transaction details, to support intelligence and financial theft objectives. Detected data exfiltration activity from an internal network to an external IP address associated with known Lazarus Group operations.