c. Initial Access (ATT&CK Tactic: Initial Access)

Primary vector: Design a spearphishing campaign targeting specific FinanceForward employees. Detail the pretext, payload delivery mechanism, and expected user interaction. - Secondary vector: Identify an external service exploitation path (VPN vulnerability, web application flaw, or exposed API). -