An advanced threat actor, identified as Hafnium, has aggregated sensitive information. The data is being prepared for exfiltration. This activity was detected through abnormal file access patterns linked to known malicious IP addresses.