Starting in May 2023, Russian threat actor Sandworm used a vulnerability in Zyxel firewalls to break into the networks of twenty-two Danish companies operating in different critical infrastructure sectors.