Iranian 🇮🇷 state sponsored threat actor burned at least 3 zero-day vulnerabilities after the SOC tried to remove them from the network in UAE's 🇦🇪 critical infrastructure who were in the system for over 2 years.
-Fortinet
As per Fortinet, the environment was staging or not fully production.