APT3 initiates their attack with a well-crafted spear phishing email, targeting key employees to gain a foothold into the network. The email contains a malicious attachment designed to exploit the recipient's system.