Russian cyber attackers used two unknown flaws