Researchers have found evidence that the financially focused Cobalt cybercriminal group exploited a 17-year-old Microsoft Office vulnerability (CVE-2017-11882) in its latest campaign. The vulnerability, which comes from Offices Equation Editor, allows buffer overflows to be created when the editor is fed specially crafted files. Microsoft patched the vulnerability in November, but some believe that the original code was not available to the coders building the patch. The group typically focuses its attacks on financial targets such as banks, exchanges, insurance companies and investment funds.”]