A known security flaw in Microsoft Windows has been used by numerous state-sponsored groups for data theft and espionage since 2017.