> the threat actors sent a malicious file that contained at least one 0-day in a popular software package

i.e. not executables