Windows zero day was exploited by Buckeye alongside Equation Group tools during 2016 attacks. Exploit and tools continued to be used after Buckeye’s apparent disappearance in 2017.
Source: Symantec
Buckeye: Espionage Outfit Used Equation Group Tools Prior to Shadow Brokers Leak