Sandworm has initiated an attack by sending a spear-phishing email to a TNT Express employee. The objective is to compromise user credentials and gain a foothold in the network. The email contains a malicious attachment that, when opened, attempts to harvest credentials.