The Calypso APT group has exploited an unpatched ProxyLogon vulnerability in order to gain initial access to government email servers. This activity was detected by the NIDS as the group initiated exploitation attempts from a known malicious IP address, aiming to establish a foothold for further intrusion.