Use of undisclosed zero day vulnerabilities by governments is not really news. But the article makes it sounds like these OS come with a rootkit pre-installed to exploit those vulnerabilities. My guess is that they first need to find a way to install these on targeted devices. Any idea?