InfoSecBulletin Cybersecurity for mankind
Google’s Threat Intelligence Group (GTIG) reported that in the year 2024, attackers exploited 75 zero-day vulnerabilities, with over 50% related to spyware attacks.
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
The number of zero-day vulnerabilities is down from 97 in 2023 but up from 63 in 2022. GTIG analysts note that this year-to-year fluctuation reflects an overall trend of increasing attacks exploiting zero-day vulnerabilities, defined as those exploited before vendors issue patches.
In 2024, over half of zero-day attacks were attributed to cyber-espionage threats from government-backed groups and commercial surveillance customers. China-linked groups used five zero-days, commercial surveillance customers exploited eight, and North Korean operators were linked to five zero-day exploits for the first time, combining espionage and financial motives.
In 2022, Google’s Threat Analysis Group and Mandiant reported 97 zero-days exploited in attacks, a 50% increase from the 62 vulnerabilities in 2021. Many of these were tied to spyware vendors and their clients.
Annual counts have varied significantly over the past four years, but the overall trend is a steady rise in zero-day exploitation. In 2024, end-user platforms and products like web browsers, mobile devices, and desktop operating systems were most affected.
End-user platforms and products, like web browsers and mobile devices, accounted for 56% of tracked zero-days. Exploits targeting browsers decreased from 17 in 2023 to 11 in 2024, while mobile device zero-days dropped from 17 to nine.
Google Chrome stayed the main browser target, with desktop OS exploits increasing from 17 to 22. Windows zero-days rose to 22 last year, compared to 16 in 2023 and 13 in 2022.
“As long as Windows remains a popular choice both in homes and professional settings, we expect that it will remain a popular target for both zero-day and n-day (i.e. a vulnerability exploited after its patch has been released) exploitation by threat actors,” GTIG said.
In 2024, attackers exploited 33 out of 75 zero-day flaws (44%) targeting products mainly used in business environments, an increase from 37% in 2023.
Security and networking software and appliances were responsible for 20 zero-days exploited in the wild, over 60% of those targeting enterprises. Attackers prefer these because compromising just one device can give them extensive system access, often without needing complex multi-stage exploits.
GTIG threat analysts identified significant zero-day vulnerabilities exploited in 2024, affecting Ivanti Cloud Services Appliance, Cisco Adaptive Security Appliance, Palo Alto Networks PAN-OS, and Ivanti Connect Secure VPN.
“Zero-day exploitation continues to grow at a slow but steady pace. However, we’ve also started seeing vendors’ work to mitigate zero-day exploitation start to pay off,” said Casey Charrier, Senior Analyst at Google Threat Intelligence Group.
“For instance, we have observed fewer instances of zero-day exploitation targeting products that have been historically popular, likely due to efforts and resources many large vendors have invested in order to prevent exploitation,”
“At the same time, we’re seeing zero-day exploitation shift towards the increased targeting of enterprise-focused products, which requires a wider and more diverse set of vendors to increase proactive security measures. The future of zero-day exploitation will ultimately be dictated by vendors’ decisions and ability to counter threat actors’ objectives and pursuits.
