The attackers initiated their operation by launching a tailored spear phishing campaign aimed at Sony employees, leveraging social engineering tactics to deliver malicious payloads. A suspicious email with a malicious attachment was detected, originating from a known malicious public IP address.