InfoSecBulletin Cybersecurity for mankind
Google’s Threat Intelligence Group (GTIG) reported that in the year 2024, attackers exploited 75 zero-day vulnerabilities, with over 50% related to spyware attacks.
CISA alerts on multiple PaperCut NG/MF flaws being actively exploited
Fire Ant hackers convert Cisco routers into spy platforms
Five Critical WordPress Flaws Lead to Site Takeover or RCE
700 AI agents united to hack Hugging Face after breaking isolation
ServiceNow warns of three critical security vulnerabilities
100+ Tech and Security Orgs Urge Global Cyber Defense Boost Against AI Threats
8.7 Million Customers data exposed from 3 AirportsÂ
Crack 85 Accounts and Steal 2,500+ Records
8-Agent AI Framework Used to Compromise Gov’t Entities in Asia
270+ Zimbra servers compromised in continuous attacks
Singapore Approves 200MW Data-Centre Expansion Under Second Call
The number of zero-day vulnerabilities is down from 97 in 2023 but up from 63 in 2022. GTIG analysts note that this year-to-year fluctuation reflects an overall trend of increasing attacks exploiting zero-day vulnerabilities, defined as those exploited before vendors issue patches.
In 2024, over half of zero-day attacks were attributed to cyber-espionage threats from government-backed groups and commercial surveillance customers. China-linked groups used five zero-days, commercial surveillance customers exploited eight, and North Korean operators were linked to five zero-day exploits for the first time, combining espionage and financial motives.
In 2022, Google’s Threat Analysis Group and Mandiant reported 97 zero-days exploited in attacks, a 50% increase from the 62 vulnerabilities in 2021. Many of these were tied to spyware vendors and their clients.
Annual counts have varied significantly over the past four years, but the overall trend is a steady rise in zero-day exploitation. In 2024, end-user platforms and products like web browsers, mobile devices, and desktop operating systems were most affected.
End-user platforms and products, like web browsers and mobile devices, accounted for 56% of tracked zero-days. Exploits targeting browsers decreased from 17 in 2023 to 11 in 2024, while mobile device zero-days dropped from 17 to nine.
Google Chrome stayed the main browser target, with desktop OS exploits increasing from 17 to 22. Windows zero-days rose to 22 last year, compared to 16 in 2023 and 13 in 2022.
“As long as Windows remains a popular choice both in homes and professional settings, we expect that it will remain a popular target for both zero-day and n-day (i.e. a vulnerability exploited after its patch has been released) exploitation by threat actors,” GTIG said.
In 2024, attackers exploited 33 out of 75 zero-day flaws (44%) targeting products mainly used in business environments, an increase from 37% in 2023.
Security and networking software and appliances were responsible for 20 zero-days exploited in the wild, over 60% of those targeting enterprises. Attackers prefer these because compromising just one device can give them extensive system access, often without needing complex multi-stage exploits.
GTIG threat analysts identified significant zero-day vulnerabilities exploited in 2024, affecting Ivanti Cloud Services Appliance, Cisco Adaptive Security Appliance, Palo Alto Networks PAN-OS, and Ivanti Connect Secure VPN.
“Zero-day exploitation continues to grow at a slow but steady pace. However, we’ve also started seeing vendors’ work to mitigate zero-day exploitation start to pay off,” said Casey Charrier, Senior Analyst at Google Threat Intelligence Group.
“For instance, we have observed fewer instances of zero-day exploitation targeting products that have been historically popular, likely due to efforts and resources many large vendors have invested in order to prevent exploitation,”
“At the same time, we’re seeing zero-day exploitation shift towards the increased targeting of enterprise-focused products, which requires a wider and more diverse set of vendors to increase proactive security measures. The future of zero-day exploitation will ultimately be dictated by vendors’ decisions and ability to counter threat actors’ objectives and pursuits.
