Google: 97 zero-days exploited in 2024, over 50% in spyware attacks

Google's Threat Intelligence Group (GTIG) says attackers exploited 75 zero-day vulnerabilities in the wild last year, over 50% of which were linked to spyware attacks. These numbers are down from 97 zero-days in 2023 but up from 63 in 2022, which GTIG analysts attributed to year-to-year swings reflecting expected variation within an upward trajectory for attacks exploiting zero-days, which the company defines as vulnerabilities exploited in the wild before vendors release patches. They noted that cyber-espionage threat actors—including government-backed groups and commercial surveillance vendors' customers—were responsible for more than half of attributable zero-day attacks in 2024. Out of these, China-linked groups exploited five zero-days, commercial surveillance customers eight, while North Korean operators were linked to five zero-day exploits for the first time, used in attacks blending espionage and financial motives. Last year, Google's Threat Analysis Group (TAG) and Google ... Read full article.