Discovered being exploited in the wild by FireEye  on May 8, 2016, patched 4 days later with Flash 18.104.22.168, CVE-2016-4117 is making its way to Exploit Kits.
CVE confirmed by FireEye - Thanks !
On 2016-05-21 Magnitude is firing an exploit to Flash up to 22.214.171.124.
|Magnitude firing exploit to Flash 126.96.36.199 - 2016-05-21|
|Magnitude Flash Exploit showing import of the DeleteRangeTimelineOperation|
Fiddler sent here.Updates to come as it appears to be a work in progress.
Spotted by Eset.
|2016-05-23 Neutrino successfully exploit CVE-2016-4117 on Flash 188.8.131.52 and drop here CryptXXX|
Fiddler sent here Password is malware
Out of topic payload: 110891e2b7b992e238d4afbaa31e165a6e9c25de2aed442574d3993734fb5220 CryptXXX
CVE identification by Henri Nurmi from F-Secure. Thanks !
|Angler EK successfully exploit Flash 184.108.40.206 on 2016-05-23 dropping Dridex|
Fiddler sent here
Out of topic payload : 99a6f5674b738591588416390f22dedd8dac9cf5aa14d0959208b0087b718902
Most likely Dridex 123 targeting Germany based on distribution path.
 CVE-2016-4117: Flash Zero-Day Exploited in the Wild - 2016-05-13 - Genwei Jiang - FireEye
 New Flash Vulnerability CVE-2016-4117 Shares Similarities With Older Pawn Storm Exploit - 2016-05-13 - Moony Li - TrendMicro