After gaining access to victims’ networks, Royal actors disable antivirus software and exfiltrate large amounts of data before ultimately deploying the ransomware and encrypting the systems.

Source: https://nakedsecurity.sophos.com/2023/03/03/feds-warn-about-right-royal-ransomware-rampage-that-runs-the-gamut-of-ttps/

Hackers need to establish a foothold, navigate through their victim's network and exfiltrate data — all while remaining undetected.

Source: https://www.gadgets360.com/internet/news/moveit-breach-hackers-interest-file-transfer-tools-explained-4128317