Usually the most advanced attacks are a few chained zero days or a zero day on top of a configuration /patching error. The worst attacks are when a zero day for wordpress or outlook comes out.