### Summary
Following the alert on suspicious access to the university network, further investigation has revealed that APT40 utilized spear-phishing emails to target university staff, leading to credential theft. These credentials were then used to access the university's internal network.

### Detailed Findings
- **Phishing Campaign**: APT40 crafted emails with attachments masquerading as legitimate maritime research documents, luring victims into opening them.
- **Credential Harvesting**: Upon opening, malicious scripts captured login credentials, which were then used in lateral movement attempts.

### Next Steps
Monitor for signs of malware execution, as this is the typical progression post-initial access in APT40 operations.