A phishing email with a malicious zip attachment initiates the attack. The zip contains a single executable disguised as an Excel file using Left-To-Right Override characters (LTRO).  LTRO makes the filename appears to have a harmless .xlsx extension (e.g., RFQ-101432620247flexe.xlsx) while it’s actually an executable (.exe).

Source: GBHackers