The attackers created a manipulated SEO download page that appeared at the top of Bing search results for an admin tool. An employee clicked on the link, a trojan was installed, and the attackers gained access to the network via a backdoor. Data was exfiltrated and the network was subsequently encrypted.