A spear-phishing email was detected targeting a regional government employee. The email contained a RoyalRoad RTF file, commonly used by Naikon APT to exploit vulnerabilities in Microsoft Word for initial access.