In the final stage of the operation, attackers attempted to exfiltrate sensitive diplomatic communications and data. The DLP system detected unusual data transfer activities originating from an internal host to an external IP address associated with known malicious activity.