Lazarus Group initiated an attack by targeting key personnel with spear-phishing emails, aiming to gain access to the bank's internal network. The email contained a malicious attachment disguised as a routine document.