A phishing email purportedly from a trusted source was detected, containing a malicious attachment intended to gain initial access to the network. The email originated from an IP address associated with malicious activity and contained a known malware hash used by the Mount Locker group.