- Engineer — Plan: If your environment runs LibreOffice or OpenOffice with Java support enabled, audit those deployments and disable Java as a mitigation now; monitor for a vendor patch and apply it promptly when released. No active exploitation yet, but the attack surface (malicious file opened by a user) is realistic.
- SOC/IR — Learn: No active exploitation or published IOCs yet, so there is nothing actionable to hunt; worth tracking in case threat actors weaponize this for phishing lure campaigns delivering malicious spreadsheets.
- Leader — Skip