FIN7 initiated an attack by exploiting a vulnerability in the HVAC vendor's network, providing an entry point into Target's infrastructure. The attack was detected through unusual traffic patterns in the firewall logs, originating from a known malicious IP associated with FIN7 operations.