Chinese state-sponsored cyber actors have been observed:  Exploiting vulnerable devices immediately after conducting scans for critical zero-day or publicly disclosed vulnerabilities. The cyber actors used or modified public proof of concept code in order to exploit vulnerable systems.  Targeting Microsoft Exchange offline address book (OAB) virtual directories (VDs).  Exploiting Internet accessible webservers using webshell small code injections against multiple code languages, including net, asp, apsx, php, japx, and cfm.