August 31, 2022 By Jonathan Reed 2 min read

Zero-day vulnerabilities are increasing. Attackers can exploit these weaknesses in the wild before a patch becomes publicly available. Until white hats mitigate a zero-day vulnerability, actors can freely exploit it to breach data, systems and networks. According to a Mandiant Threat Intelligence report, the number of zero-day exploits in 2021 grew more than 100% compared to the previous record set in 2019. This means that during the last decade about 40% of all zero-day attacks occurred in 2021 alone.

The most frequent zero-day exploits involved Microsoft, Apple and Google products. The rapid growth in zero-day attacks represents a major threat to any industry worldwide due to how common the target products are.

Record number of zero-day exploits

In 2021, the Mandiant report found 80 zero-days exploited, which more than doubled the previous record set in 2019.

The primary actors exploiting these vulnerabilities continue to be state-sponsored groups. The researchers also detected a notable rise in financially driven attacks. The study showed that 33% of zero-day attackers sought financial gain, especially ransomware gangs.

Ongoing investigation

The report’s conclusions included original research, breach investigation findings and open sources. Researchers stated that they could not confirm the sources of some findings. As incident forensic investigation unfolds, further insight into the full impact of zero-day incidents will continue to develop.

Causes of increased zero-day attacks

To explain the increase in zero-day exploits, the authors of the report suggest several potential driving forces, such as:

  • More cloud hosting, mobile and Internet of Things technologies increase the volume and complexity of systems and devices. That is, more software leads to more software flaws.
  • The growth of the exploit broker marketplace results in more research into zero-days by private companies, researchers and threat actors.
  • More robust defense and detection efforts may increase zero-day exploit reporting.
  • Tightened security protocols against other vectors mean threat groups must resort to zero-day targets.

State-sponsored versus financial motivation

In the past, state-sponsored zero-day incidents made up the bulk of this type of attack. China-based cyber spy groups were involved in more zero-days than any other nation-state in 2021. The report states that at least 10 separate countries have likely exploited zero-days since 2012.

Meanwhile, financially motivated attacks also increased last year. From 2014 to 2018, only a small number of financially motivated attacks targeted zero-day vulnerabilities. However, by 2021, roughly one-third of all zero-day exploits were financially motivated.

Zero-day and ransomware

As global ransomware activity has grown, the number of ransomware attacks exploiting zero-day vulnerabilities has also increased. The report suggests that ransomware groups may be recruiting or purchasing services linked to formerly developed exploit kits.

The research shows that 75% of total zero-day vulnerabilities involve Microsoft, Apple and Google products. As much of the world relies on these products, zero-day threats will continue to be a challenge for security officers in the future.

More from News

CISA releases landmark cyber incident reporting proposal

2 min read - Due to ongoing cyberattacks and threats, critical infrastructure organizations have been on high alert. Now, the Cybersecurity and Infrastructure Security Agency (CISA) has introduced a draft of landmark regulation outlining how organizations will be required to report cyber incidents to the federal government. The 447-page Notice of Proposed Rulemaking (NPRM) has been released and is open for public feedback through the Federal Register. CISA was required to develop this report by the Cyber Incident Reporting for Critical Infrastructure Act of…

Recent developments and updates in Biden cyber policy

3 min read - The White House recently released its budget for the 2025 fiscal year, which supports the government’s commitment to cybersecurity. The cybersecurity funding allocations line up with the FY 2025 cybersecurity spending priorities released last year that included the following pillars: Defend critical infrastructure Disrupt and dismantle threat actors Shape market forces to drive security and resilience Invest in a resilient future Forge international partnerships to pursue shared goals. In 2023, the White House released a 35-page document detailing the new…

Change Healthcare cyberattack causes dire billing crisis

3 min read - Last month’s cyberattack on Change Healthcare, a sizable unit of UnitedHealth Group, brought new repercussions rarely seen in a cyberattack. As a result of the threat actor’s actions, healthcare systems and providers suffered cash flow issues, which resulted in providers being unable to pay their rent, owners dipping into their personal savings and patients being prevented from receiving important medications. Most importantly, patients are unable to get insurance approval for procedures, surgeries and prescriptions, which can affect their health outcomes.…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today