A spear phishing email was detected targeting an employee with a malicious link intended to harvest credentials. The email originated from a known malicious IP address associated with the Maze ransomware group.