After a user opens the malicious attachment, BlackEnergy malware is executed, providing the attackers with a foothold in the network. Endpoint Detection and Response (EDR) alerts on suspicious process activity linked to known malware signatures.