APT41 initiated access by exploiting a vulnerability in an outdated VPN service, aiming to establish a persistent network presence. The activity was detected originating from a known malicious IP address attempting to communicate with the internal network.