An unauthorized access attempt was detected from an external IP leveraging a known vulnerability in Baltimore's remote access tool. The attacker tried to exploit the system using a tool associated with beginner-level cyber operations.