Google: Spyware vendors behind 50% of zero-days exploited in 2023

Google's Threat Analysis Group (TAG) and Google subsidiary Mandiant said they've observed a significant increase in the number of zero-day vulnerabilities exploited in attacks in 2023, many of them linked to spyware vendors and their clients. Last year's count reached 97 zero-days exploited in attacks, representing a surge of over 50 percent compared to the previous year's 62 vulnerabilities. Despite this rise, the figure remains below the peak of 106 zero-day bugs exploited in 2021. Mandiant and TAG collectively discovered 29 instances out of 97 vulnerabilities, with 61 affecting end-user platforms and products (including mobile devices, operating systems, browsers, and various other apps). The remaining 36 vulnerabilities were used to target enterprise-focused technologies such as security software and devices. "On the enterprise side, we see a wider variety of vendors and products targeted, and an increase in enterprise-specific technologies being exploited," Google warned [PDF]. "Over the years we've learned that the quicker we discover and patch attackers' bugs, the shorter the lifespan of the exploit, and the more it costs attackers to maintain their capabilities." Last year, financially motivated actors used ten zero-day vulnerabilities, less than what was observed in 2022. Among these, the FIN11 threat group exploited three separate zero-day vulnerabilities, while at least four ransomware groups exploited another four zero-days. China was linked to the most governmen...