Hackers Working for Governments WRE Responsible New research from google,
Google’s report said that the number of zero-day Explits – Referring to Security Flaws that was unknown to the software makers at the time hackers abused them – Had dropped from 98 exlits in 2023 to 75 exploits in 2024. But the report noted Proportion of zero-days that google could attribute-meaning identifying the hackers who were responsible for exploiting them-at least 23 zero-day experts Wi-DAYE ExPLITS WERE LINKED to Government-Backed Hacked Hacked Hacked Hacked Hacked
Among Theose 23 Explits, 10 Zero-Days Working Directly for Governments, Including Five Explits Linked To North Korea.
Another eight exploits were identified as having been developed by spyware makers And Survelance enablers, such as nso group, which typically claim to only sell to governments. Among these eight exploits made by spyware companies, google is also counting bugs That wasre recently exploited By Serbian Authorities Using Cellebrite Phone-Unlock devices.
Despite the fact that there was eight recorded cases of zero-days developed by spyware makers, clément lecigne, a security engineer at google’s thret in intelligence, group (GTIG) Thatay Companies “Are Investing More Resources in Operational Security to Prevent their capabilityes being with exposed and to not end in the news.”
Google added that surveillance vendors continue to proliferate.
“In instances where law enforcement action or public disclosure has pushed vendors out of business, we’ve seen new vendors Arise to Provide Similar Services,” James Sadowski, A PRINCIPAL Analyst At GTIG, Told Techcrunch. “As long as government customers continue to request and pay for these services, the industry will continue to grow.”
The Remaining 11 Attributeed Zero-Days WHELY EXPLEED BY CYBERMINALS, Such as Ransomware Operators targeting enterprise devicesIncluding vpns and routers.
The report also found that the majority of the total 75 zero-days exploited during 2024 was targeting consumer platforms and products, like phones and browsers; While the rest exploited devices typically found on corporate networks.
The good news, according to google’s report, is that software makers defending against zero-day attacks are Increasing it more difference for exficult for exfloit makers to Find Bugs.
“We are seeing notable decreases in zero-day exploitation of some historically Popular targets such as browsers and mobile operating systems,” Per the report.
Sadowski specifically pointed to Lockdown Modea special feature for iOS and macos that disables certification with the goal of hardening cellphones and computers, which has a proven track record of stopping government hackers; as well as Memory Tagging Extension (MTE), a security feature of modern google pixel chipsets that helps detect search types of bugs and improve device security.
Reports like Google’s are valuable because they give the industry, and observers, data points that contribute to our undersrstanding of how government havenment havers open Counting zero-days is that, by natural, some of them go undetected, and of that that are detected, some still go without attribution.