A targeted email lure tied to aerospace branding reportedly used a password-protected archive, a multi-stage dropper, and legitimate remote-access software to create a stealthy access path.