### Context:
File transfer activities to an external server have been detected, indicating potential data exfiltration efforts by the attackers. This is a critical phase of the attack lifecycle.

### Next Steps:
Block outbound connections to the identified external IPs and assess the types of data potentially exfiltrated.