A spear-phishing email was detected attempting to compromise user credentials. The email contained a malicious attachment and was sent from a known malicious IP address linked to Earth Lusca. The operation is believed to be in its initial phase.