The threat group exfiltrates data prior to deploying ransomware and leaks the stolen information if a ransom is not paid. The group has demanded multi-million dollar ransoms from some victims.