In the final act, Cl0p exfiltrates data to external servers and initiates a unique extortion campaign, threatening public release rather than deploying ransomware. The operation involved transferring large volumes of data to a known malicious IP associated with Cl0p's command and control infrastructure.