Google: 97 zero-days exploited in 2024, over 50% in spyware attacks

Google's Threat Intelligence Group (GTIG) says attackers exploited 75 zero-day vulnerabilities in the wild last year, over 50% of which were linked to spyware attacks. These numbers are down from 97 zero-days in 2023 but up from 63 in 2022, which GTIG analysts attributed to year-to-year swings reflecting expected variation within an upward trajectory for attacks exploiting zero-days, which the company defines as vulnerabilities exploited in the wild before vendors release patches. They noted that cyber-espionage threat actors—including government-backed groups and commercial surveillance vendors' customers—were responsible for more than half of attributable zero-day attacks in 2024. Out of these, China-linked groups exploited five zero-days, commercial surveillance customers eight, while North Korean operators were linked to five zero-day exploits for the first time, used in attacks blending espionage and financial motives. Last year, Google's Threat Analysis Group (TAG) and Google subsidiary Mandiant saw 97 zero-days exploited in attacks, a surge of over 50 percent compared to the previous year's 62 vulnerabilities, many also linked to spyware vendors and their clients. While annual counts have fluctuated massively over the past four years, the average trend line shows a steady increase in zero-day exploitation. In 2024, end-user platforms and products (e.g., web browsers, mobile devices, and desktop operating systems) bore the brunt of this activity, End-user platforms and...