75 Zero-Days Exploited in 2024 With Focus on Enterprise Tech

upstart writes:

As Big Tech gets used to the pain, smaller vendors urged to up their game:

Google says that despite a small dip in the number of exploited zero-day vulnerabilities in 2024, the number of attacks using these novel bugs continues on an upward trend overall

Data released by Google Threat Intelligence Group (GTIG) today, timed with the ongoing RSA Conference 2025, revealed that 75 zero-days were exploited last year. The number is down from 2023's figure of 98, but an increase from 63 the year before, suggesting that zero-days continue to be a hot commodity for the most well-resourced attackers.

Over 50 percent of the confirmed zero-days were used for cyberespionage campaigns carried out by state-sponsored groups and customers of spyware companies, or as Google calls them, "commercial surveillance vendors."

Google's researchers highlighted China and spyware companies - none of which were named specifically - as the main culprits here, exploiting five and eight zero-days respectively in 2024.

However, North Korea also featured with its state-backed attackers accounting for five zero-day exploits - the first time the country has been mentioned in the same breath as the usual leaders in this regard.

"GTIG tracked 75 exploited-in-the-wild zero-day vulnerabilities that were disclosed in 2024," said Google's researchers. "This number appears to be consistent with a consolidating upward trend that we have observed over the last four years.

"After an initial spike in 2021, yearly counts have fluctuated but not returned to the lower numbers we saw in 2021 and prior."

Google noted, however, that the surge in confirmed zero-day exploits from 2021 onward, compared to figures from years before that, could well be due to the industry's improvements both in technical detections and public disclosures of such attacks.

Read more of this story at SoylentNews.