CTI First Principles: Threat Actors and Attribution Question 8

For the question: 

Which sub-technique has been attributed to this threat actor in the Credential Access Tactic? 

as the briefing was talking about phishing through attachment, for some reason, the answer Spearphishing Attachment, was not correct. I am wondering about where else I shoud be looking into as the main report mostly taked about email delivery methods in terms of initial access to credentials