The attackers initiated their operation by sending a spear-phishing email to the employee, attempting to steal credentials and gain a foothold in the network. The email contained a malicious attachment intended to execute a payload if opened.