on october 31, 2016, google's threat analysis group revealed a zero-day vulnerability in most microsoft windows versions that is the subject of active malware attacks. on november 1, 2016, microsoft executive vice president of the windows and devices group terry myerson posted to microsoft's threat research & response blog, acknowledging the vulnerability and explaining that a "low-volume spear-phishing campaign" targeting specific users had utilized "two zero-day vulnerabilities in adobe flash and the down-level windows kernel." microsoft pointed to fancy bear as the threat actor, referring to the group by their in-house code name "strontium".