In the final stage, the attackers successfully exfiltrated sensitive data using encrypted channels to evade detection, completing their espionage mission. The data was sent to an external IP associated with known malicious activities.