An unsuspecting employee opened a PDF attachment, triggering a hidden script that executed malware, establishing a foothold for APT1. The PDF was designed to exploit a vulnerability in the PDF reader, allowing remote code execution.