A blog post by Mandiant researchers on Jan. 19 detailed a "suspected China-nexus campaign" that utilized a new malware it named BOLDMOVE, specifically built to exploit CVE-2022-42475. The researchers uncovered evidence that exploitation occurred as early as October 2022 when the flaw was still a zero day and had not been publicly disclosed.