Groundbait initiated their campaign with targeted spear-phishing emails sent to activists, embedding malicious attachments designed to breach personal accounts. The email was identified with a suspicious attachment and a known malicious IP address.