It's a vulnerability that's discovered and exploited before it's known to or addressed by the maker/vendor. So in this case, the North Korean hackers were exploiting an unknown vulnerability in a software package commonly used by security researchers.