## Context
After detecting the spear-phishing email, further analysis revealed that the email contained a link to a malicious document disguised as an official communication from a well-known financial institution.

## Insight
The document exploited a known vulnerability in an outdated version of a popular document viewer installed on many systems within the targeted cryptocurrency exchanges. Once opened, it initiated the download and execution of a payload designed to establish a foothold in the network.

## Next Steps
Teams should implement immediate patches to all document viewers and monitor for any signs of unauthorized document execution across the network.