Hackers from Sandworm exploited a zero-day vulnerability in Exim mail transfer agent software, which runs on email servers around the world, granting them the ability to remotely execute commands on the compromised servers.