In the provided report, the analysts divided the attack into two stages. In Stage $1$ the threat actors used several capabilities to achieve their goals. Which of the following was NOT a capability used in Stage $1$ of the attack?

Group of answer choices

Credential harvesting using the BlackEnergy$3$ malware

Spear phishing emails

Developed exploit code to attack field devices.

Manipulation of authentication and authorization systems