### Report: Initial Access via Phishing

**Summary:**
The first phase of the Conti ransomware attack on Costa Rica was initiated through a sophisticated phishing campaign. Emails containing malicious attachments or links were sent to various government employees, masquerading as official communications.

**Technical Details:**
- **Sender:** Spoofed email addresses mimicking legitimate government domains.
- **Attachments/Links:** Contained malicious payloads designed to execute upon interaction.
- **Indicators of Compromise (IOCs):**
  - Known malicious domains used for phishing.
  - Hashes of malicious attachments.

**Recommendations:**
- Immediate education and awareness training for government employees.
- Implementation of robust email filtering and phishing detection solutions.

The next phase involves analyzing the execution of the malicious scripts detected within the network.