In the final stage, DarkSide attempts to exfiltrate sensitive operational data, which could be used for ransom or sold on the black market. The DLP system detected an unauthorized data transfer to an external IP address.