The attackers compressed sensitive data and exfiltrated it to a remote server. The data was observed being sent from an internal IP to a suspicious external IP. The operation involved compressing files before transmission, indicating a step in a larger data exfiltration campaign targeting compromised Pakistani entities.