August 31, 2022 By Jonathan Reed 2 min read

Zero-day vulnerabilities are increasing. Attackers can exploit these weaknesses in the wild before a patch becomes publicly available. Until white hats mitigate a zero-day vulnerability, actors can freely exploit it to breach data, systems and networks. According to a Mandiant Threat Intelligence report, the number of zero-day exploits in 2021 grew more than 100% compared to the previous record set in 2019. This means that during the last decade about 40% of all zero-day attacks occurred in 2021 alone.

The most frequent zero-day exploits involved Microsoft, Apple and Google products. The rapid growth in zero-day attacks represents a major threat to any industry worldwide due to how common the target products are.

Record number of zero-day exploits

In 2021, the Mandiant report found 80 zero-days exploited, which more than doubled the previous record set in 2019.

The primary actors exploiting these vulnerabilities continue to be state-sponsored groups. The researchers also detected a notable rise in financially driven attacks. The study showed that 33% of zero-day attackers sought financial gain, especially ransomware gangs.

Ongoing investigation

The report’s conclusions included original research, breach investigation findings and open sources. Researchers stated that they could not confirm the sources of some findings. As incident forensic investigation unfolds, further insight into the full impact of zero-day incidents will continue to develop.

Causes of increased zero-day attacks

To explain the increase in zero-day exploits, the authors of the report suggest several potential driving forces, such as:

  • More cloud hosting, mobile and Internet of Things technologies increase the volume and complexity of systems and devices. That is, more software leads to more software flaws.
  • The growth of the exploit broker marketplace results in more research into zero-days by private companies, researchers and threat actors.
  • More robust defense and detection efforts may increase zero-day exploit reporting.
  • Tightened security protocols against other vectors mean threat groups must resort to zero-day targets.

State-sponsored versus financial motivation

In the past, state-sponsored zero-day incidents made up the bulk of this type of attack. China-based cyber spy groups were involved in more zero-days than any other nation-state in 2021. The report states that at least 10 separate countries have likely exploited zero-days since 2012.

Meanwhile, financially motivated attacks also increased last year. From 2014 to 2018, only a small number of financially motivated attacks targeted zero-day vulnerabilities. However, by 2021, roughly one-third of all zero-day exploits were financially motivated.

Zero-day and ransomware

As global ransomware activity has grown, the number of ransomware attacks exploiting zero-day vulnerabilities has also increased. The report suggests that ransomware groups may be recruiting or purchasing services linked to formerly developed exploit kits.

The research shows that 75% of total zero-day vulnerabilities involve Microsoft, Apple and Google products. As much of the world relies on these products, zero-day threats will continue to be a challenge for security officers in the future.

More from News

New memo reveals Biden’s cybersecurity priorities through fiscal year 2026

2 min read - On July 10, 2024, the White House released a new memo regarding the Biden administration’s cybersecurity investment priorities, initially proposed in July 2022. This new memorandum now marks the third time the Office of the National Cyber Director (ONCD), headed by Harry Coker, has released updated priorities and outlined procedures regarding the five core pillars of the National Cybersecurity Strategy Implementation Plan (NCSIP), now relevant through fiscal year 2026. Key highlights from the FY26 memorandum In the latest annual version…

Hackers are increasingly targeting auto dealers

3 min read - Update as of July 11, 2024 In late June, more than 15,000 car dealerships across North America were affected by a cyberattack on CDK Global, which provides software to car dealers. After two cyberattacks over two days, CDK shut down all systems, which caused delays for car buyers and disruptions for the dealerships. Many dealerships went back to manual processes, including handwriting up orders, so that sales could continue at a slower pace. Car buyers who recently bought a car from…

CISA director says banning ransomware payments is off the table

3 min read - The FBI, CISA and NSA all strongly advise against organizations making ransomware payments if they fall victim to ransomware attacks. If so, why not place a ban on paying ransomware demands? The topic came up at a recent Oxford Cyber Forum. Jen Easterly, Director of CISA, commented on the issue, saying, “I think within our system in the U.S. — just from a practical perspective — I don’t see it happening.” It’s unlikely this was a purely spontaneous remark as the…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today