You see confidential data being exfiltrated to an IP address that is attributed to a known Advanced Persistent Threat group. Assume that this is part of a real attach and not a network misconfiguration.

Which category does this event fall under as defined in the Diamond Model of Intrusion?