InfoSecBulletin Cybersecurity for mankind
Google’s Threat Intelligence Group (GTIG) reported that in the year 2024, attackers exploited 75 zero-day vulnerabilities, with over 50% related to spyware attacks.
AI Finds Nation-State-Level Zoom Flaw in Under 24 Hours, Zero-Click Attack Exposed
Hacker Actively Exploit SonicWall and SharePoint Flaws
Gunra Ransomware Leverage Fortinet VPN Flaws to Evade MFA Obtaining Enterprise Data
Hackers accessed a US defense manufacturer’s Microsoft 365 account via phishing.
Google Play Apps Utilize Stealth Loaders to Spread Anatsa Banking Malware
Bangladeshi org listed “the Gentlemen’ ransomware victim list: CIRT warns
Around 800 Malicious npm Packages Distribute Cross-Platform RAT and Infostealer
Google Chrome 151 Update Fixes 41 Flaws, 6 Critical
Swiss gov.t SharePoint incident compromised 200 accounts
Azad president, Secretary Post Heads to Contest: ISACA Dhaka Chapter Election
The number of zero-day vulnerabilities is down from 97 in 2023 but up from 63 in 2022. GTIG analysts note that this year-to-year fluctuation reflects an overall trend of increasing attacks exploiting zero-day vulnerabilities, defined as those exploited before vendors issue patches.
In 2024, over half of zero-day attacks were attributed to cyber-espionage threats from government-backed groups and commercial surveillance customers. China-linked groups used five zero-days, commercial surveillance customers exploited eight, and North Korean operators were linked to five zero-day exploits for the first time, combining espionage and financial motives.
In 2022, Google’s Threat Analysis Group and Mandiant reported 97 zero-days exploited in attacks, a 50% increase from the 62 vulnerabilities in 2021. Many of these were tied to spyware vendors and their clients.
Annual counts have varied significantly over the past four years, but the overall trend is a steady rise in zero-day exploitation. In 2024, end-user platforms and products like web browsers, mobile devices, and desktop operating systems were most affected.
End-user platforms and products, like web browsers and mobile devices, accounted for 56% of tracked zero-days. Exploits targeting browsers decreased from 17 in 2023 to 11 in 2024, while mobile device zero-days dropped from 17 to nine.
Google Chrome stayed the main browser target, with desktop OS exploits increasing from 17 to 22. Windows zero-days rose to 22 last year, compared to 16 in 2023 and 13 in 2022.
“As long as Windows remains a popular choice both in homes and professional settings, we expect that it will remain a popular target for both zero-day and n-day (i.e. a vulnerability exploited after its patch has been released) exploitation by threat actors,” GTIG said.
In 2024, attackers exploited 33 out of 75 zero-day flaws (44%) targeting products mainly used in business environments, an increase from 37% in 2023.
Security and networking software and appliances were responsible for 20 zero-days exploited in the wild, over 60% of those targeting enterprises. Attackers prefer these because compromising just one device can give them extensive system access, often without needing complex multi-stage exploits.
GTIG threat analysts identified significant zero-day vulnerabilities exploited in 2024, affecting Ivanti Cloud Services Appliance, Cisco Adaptive Security Appliance, Palo Alto Networks PAN-OS, and Ivanti Connect Secure VPN.
“Zero-day exploitation continues to grow at a slow but steady pace. However, we’ve also started seeing vendors’ work to mitigate zero-day exploitation start to pay off,” said Casey Charrier, Senior Analyst at Google Threat Intelligence Group.
“For instance, we have observed fewer instances of zero-day exploitation targeting products that have been historically popular, likely due to efforts and resources many large vendors have invested in order to prevent exploitation,”
“At the same time, we’re seeing zero-day exploitation shift towards the increased targeting of enterprise-focused products, which requires a wider and more diverse set of vendors to increase proactive security measures. The future of zero-day exploitation will ultimately be dictated by vendors’ decisions and ability to counter threat actors’ objectives and pursuits.
