The five flaws CISA added to its Known Exploited Vulnerabilities catalog land on ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND. None is new. The oldest — a ProFTPD file-copy flaw (CVE-2015-3306) rated a flat 10.0 — was patched in 2015, and the Struts command injection (CVE-2016-3081), the BIND TKEY denial-of-service (CVE-2015-5477), and the Strapi data-exposure bug (CVE-2023-22894) are all years old too. A joint advisory from seven countries' cyber agencies ties the activity to Integrity Technology Group, a Beijing firm whose infrastructure sits under the campaign, and the FBI seized domains linked to it. If you run any of these, the advisory lists the fixed releases: ProFTPD 1.3.5a, BIND 9.9.7-P2 or 9.10.2-P3, Struts 2.3.20.3 and up, and Strapi 4.8.0. For Struts, disabling Dynamic Method Invocation works when you can't upgrade. The uncomfortable part isn't the sophistication — it's that a state crew is getting this far on bugs your patch cadence should have closed a long time ago.