An email purportedly from a trusted aerospace partner was sent to a key engineer with a malicious payload designed to deploy the HyperBro backdoor. The email originated from an IP linked to known APT27 activity.