InfoSecBulletin Cybersecurity for mankind
Google’s Threat Intelligence Group (GTIG) reported that in the year 2024, attackers exploited 75 zero-day vulnerabilities, with over 50% related to spyware attacks.
Alert
Trend Micro Apex One Flaw Allow Attackers to Inject Malicious Code
Zero-Click AI Vulnerability Exposes Microsoft 365 Copilot Data Without User Action
Adobe Releases Patch Fixing 254 Vulnerabilities With High-Severity Security Gaps
Alert
40,000 + live internet cameras exposed globally !
Microsoft patch Tuesday fix exploited zero-day and 65 vuls patched
84,000+ Roundcube instances vulnerable to actively exploited flaw
CVE-2025-24016
Critical Wazuh RCE Actively Exploited by Mirai Botnets
CISA Issues Seven Advisories for Industrial Control Systems (ICS)
ClickFix Attack Exploits Fake Cloudflare Human Check to Install Malware
Fortinet flaws now exploited in Qilin ransomware attacks
The number of zero-day vulnerabilities is down from 97 in 2023 but up from 63 in 2022. GTIG analysts note that this year-to-year fluctuation reflects an overall trend of increasing attacks exploiting zero-day vulnerabilities, defined as those exploited before vendors issue patches.
In 2024, over half of zero-day attacks were attributed to cyber-espionage threats from government-backed groups and commercial surveillance customers. China-linked groups used five zero-days, commercial surveillance customers exploited eight, and North Korean operators were linked to five zero-day exploits for the first time, combining espionage and financial motives.
In 2022, Google’s Threat Analysis Group and Mandiant reported 97 zero-days exploited in attacks, a 50% increase from the 62 vulnerabilities in 2021. Many of these were tied to spyware vendors and their clients.
Annual counts have varied significantly over the past four years, but the overall trend is a steady rise in zero-day exploitation. In 2024, end-user platforms and products like web browsers, mobile devices, and desktop operating systems were most affected.
End-user platforms and products, like web browsers and mobile devices, accounted for 56% of tracked zero-days. Exploits targeting browsers decreased from 17 in 2023 to 11 in 2024, while mobile device zero-days dropped from 17 to nine.
Google Chrome stayed the main browser target, with desktop OS exploits increasing from 17 to 22. Windows zero-days rose to 22 last year, compared to 16 in 2023 and 13 in 2022.
“As long as Windows remains a popular choice both in homes and professional settings, we expect that it will remain a popular target for both zero-day and n-day (i.e. a vulnerability exploited after its patch has been released) exploitation by threat actors,” GTIG said.
In 2024, attackers exploited 33 out of 75 zero-day flaws (44%) targeting products mainly used in business environments, an increase from 37% in 2023.
Security and networking software and appliances were responsible for 20 zero-days exploited in the wild, over 60% of those targeting enterprises. Attackers prefer these because compromising just one device can give them extensive system access, often without needing complex multi-stage exploits.
GTIG threat analysts identified significant zero-day vulnerabilities exploited in 2024, affecting Ivanti Cloud Services Appliance, Cisco Adaptive Security Appliance, Palo Alto Networks PAN-OS, and Ivanti Connect Secure VPN.
“Zero-day exploitation continues to grow at a slow but steady pace. However, we’ve also started seeing vendors’ work to mitigate zero-day exploitation start to pay off,” said Casey Charrier, Senior Analyst at Google Threat Intelligence Group.
“For instance, we have observed fewer instances of zero-day exploitation targeting products that have been historically popular, likely due to efforts and resources many large vendors have invested in order to prevent exploitation,”
“At the same time, we’re seeing zero-day exploitation shift towards the increased targeting of enterprise-focused products, which requires a wider and more diverse set of vendors to increase proactive security measures. The future of zero-day exploitation will ultimately be dictated by vendors’ decisions and ability to counter threat actors’ objectives and pursuits.
