Newly patched CVE-2019-0797 is being actively exploited by two APTs, FruityArmor and SandCat.
Source: Threadpost