tokens: FireEye believes that two actors – Turla and an unknown financially motivated actor – were using the first EPS zero-day CVE-2017-0261, and APT28 was using the second EPS zero-day CVE-2017-0262 along with a new Escalation of Privilege EOP zero-day CVE-2017-0263.