The Play APT group begins their attack by exploiting known vulnerabilities in the Exchange server, aiming to establish a foothold within the network. Anomalous login attempt detected from an external IP associated with known malicious activity.