In the final step of the attack chain, the attacker deployed a ransom note to the affected systems, demanding payment in exchange for the decryption key. This action follows the encryption of critical files across multiple hosts.