According to the discoverer, NVISO: “We can however not assess whether this exploit was part of UNC5174’s capabilities or whether the zero-day’s usage was merel

According to the discoverer, NVISO: “We can however not assess whether this exploit was part of UNC5174’s capabilities or whether the zero-day’s usage was merely accidental due to its trivialness.” This may explain the failure to notify of a 0day, since it seemed to be exploited accidentally in the course of a more sophisticated operation. But that doesn’t excuse the lack of disclosure IMO. If it’s so trivial you could accidentally exploit it, seems bad.