InfoSecBulletin Cybersecurity for mankind
Google’s Threat Intelligence Group (GTIG) reported that in the year 2024, attackers exploited 75 zero-day vulnerabilities, with over 50% related to spyware attacks.
NetamLoader malware to attack Win10: Customized for Gov.t in Asia
‘SMS of Death’ Zero-Click Flaw Disrupting Android Phones With a Single Text
NIST Unveiled Guidance for Post-Quantum Cryptography Transition
Daily Cyber security update for 29.10. 2026
Rapid7 Unveils 17 Zimbra Collaboration Suite Flaws Breaking Identity Boundaries
CISA launched two free tools Identify Security Misconfig in Microsoft 365 and Google Workspace
Apple iOS 27.2 Released Fixes 163 Flaws, Including Critical WebKit RCE
CISA adds PHP2Shell to KEV, PHP Releases New Security Updates to Fix Critical HTTP2Shell flaw
Cloudflare Unveils Emergency WAF Ruleset Update on Brotli flaw
Daily Cyber security update for 26.10. 2026
The number of zero-day vulnerabilities is down from 97 in 2023 but up from 63 in 2022. GTIG analysts note that this year-to-year fluctuation reflects an overall trend of increasing attacks exploiting zero-day vulnerabilities, defined as those exploited before vendors issue patches.
In 2024, over half of zero-day attacks were attributed to cyber-espionage threats from government-backed groups and commercial surveillance customers. China-linked groups used five zero-days, commercial surveillance customers exploited eight, and North Korean operators were linked to five zero-day exploits for the first time, combining espionage and financial motives.
In 2022, Google’s Threat Analysis Group and Mandiant reported 97 zero-days exploited in attacks, a 50% increase from the 62 vulnerabilities in 2021. Many of these were tied to spyware vendors and their clients.
Annual counts have varied significantly over the past four years, but the overall trend is a steady rise in zero-day exploitation. In 2024, end-user platforms and products like web browsers, mobile devices, and desktop operating systems were most affected.
End-user platforms and products, like web browsers and mobile devices, accounted for 56% of tracked zero-days. Exploits targeting browsers decreased from 17 in 2023 to 11 in 2024, while mobile device zero-days dropped from 17 to nine.
Google Chrome stayed the main browser target, with desktop OS exploits increasing from 17 to 22. Windows zero-days rose to 22 last year, compared to 16 in 2023 and 13 in 2022.
“As long as Windows remains a popular choice both in homes and professional settings, we expect that it will remain a popular target for both zero-day and n-day (i.e. a vulnerability exploited after its patch has been released) exploitation by threat actors,” GTIG said.
In 2024, attackers exploited 33 out of 75 zero-day flaws (44%) targeting products mainly used in business environments, an increase from 37% in 2023.
Security and networking software and appliances were responsible for 20 zero-days exploited in the wild, over 60% of those targeting enterprises. Attackers prefer these because compromising just one device can give them extensive system access, often without needing complex multi-stage exploits.
GTIG threat analysts identified significant zero-day vulnerabilities exploited in 2024, affecting Ivanti Cloud Services Appliance, Cisco Adaptive Security Appliance, Palo Alto Networks PAN-OS, and Ivanti Connect Secure VPN.
“Zero-day exploitation continues to grow at a slow but steady pace. However, we’ve also started seeing vendors’ work to mitigate zero-day exploitation start to pay off,” said Casey Charrier, Senior Analyst at Google Threat Intelligence Group.
“For instance, we have observed fewer instances of zero-day exploitation targeting products that have been historically popular, likely due to efforts and resources many large vendors have invested in order to prevent exploitation,”
“At the same time, we’re seeing zero-day exploitation shift towards the increased targeting of enterprise-focused products, which requires a wider and more diverse set of vendors to increase proactive security measures. The future of zero-day exploitation will ultimately be dictated by vendors’ decisions and ability to counter threat actors’ objectives and pursuits.
