Google Threat Intelligence Group Tracks 75 Actively Exploited Zero-Day Flaws in 2024
In a recent analysis published by Google's Threat Intelligence Group (GTIG), the organization has identified 75 actively exploited zero-day flaws in 2024, marking a significant decrease from the 98 zero-day vulnerabilities tracked in 2023.
According to GTIG's latest report, the number of zero-day exploits decreased compared to 2022, when 63 zero-day vulnerabilities were tracked. However, the researchers observed an increase in adversary exploitation of enterprise-specific technologies throughout 2024.
Evolving Attacker Tactics and Vendor Defenses
The GTIG report highlights evolving attacker tactics, better vendor defenses, and growing challenges in detecting commercial surveillance activity. The researchers noted that most targeted zero-day vulnerabilities are now end-user platforms, while attacks on enterprise tech are rising.
GTIG experts reported that in 2024, over 60% of zero-day exploits targeting enterprise tech hit security and networking tools, offering attackers efficient access to systems and networks. This represents a significant increase from the previous year, with 37% of zero-day vulnerabilities targeting enterprise products in 2023.
Zero-Day Attacks on Enterprise Tech Rise
In 2024, zero-day attacks targeting enterprise tech grew, while browser and mobile exploits dropped. End-user platforms saw 56% of zero-day activity, with Chrome remaining the most targeted web browser.
Desktop OS zero-days rose to 22, with Microsoft Windows continuing to be a major target due to its widespread use. GTIG experts noted that as long as Windows remains a popular choice both in homes and professional settings, it will remain a popular target for both zero-day and n-day exploitation by threat actors.
Enterprise Products Under Threat
Enterprise products like Ivanti, Palo Alto, and Cisco are prime targets due to limited EDR monitoring and the ability of single flaws to enable full system compromise. In 2024, over half of zero-days enabled remote code execution or privilege escalation.
According to the report, most attacks targeted security and network software. Google attributed 34 cases, with 53% tied to cyber espionage groups, mainly nation-state or commercial surveillance vendors.
Cyber Espionage Groups and Zero-Day Exploitation
"While we still expect government-backed actors to continue their historic role as major players in zero-day exploitation," said the report. "CSVs now contribute a significant volume of zero-day exploitation."
The report notes that cyber espionage groups, mainly nation-state or commercial surveillance vendors, are now contributing a significant volume of zero-day exploits. While the total count and proportion of zero-days attributed to CSVs declined from 2023 to 2024, the 2024 count is still substantially higher than the count from 2022 and years prior.
"Their role further demonstrates the expansion of the landscape and the increased access to zero-day exploitation that these vendors now provide other actors," concludes the report.