Sunday, July 14, 2024
EHA

Hackers Weaponized and Exploited Over 55 Zero-days in Microsoft, Google, and Apple

Mandiant researchers have recently reported that 55 zero-day vulnerabilities were actively exploited in 2022, most against the following brands and their products:-

  • Microsoft
  • Google
  • Apple

Researchers state that hackers are still targeting zero-day vulnerabilities in malicious campaigns. It has been reported that most of these vulnerabilities resulted in the attacker being able to either gain elevated privileges or execute remote code on vulnerable devices.

Zero-days Exploited in 2022

However, it is important to note that compared to recent years, there has been a decline in the overall number and proportion of financially motivated zero-day exploits in 2022.

There were 55 zero-day flaws exploited in 2022; 13 were exploited by cyber-espionage groups, while Chinese cyber spies exploited seven.

Seven zero-day vulnerabilities have been exploited by China so far, making the country the most prolific. And here below, we have mentioned those seven flaws:-

One of the flaws exploited by Russian threat actors overlapped with another two flaws exploited by North Koreans. In three cases, Mandiant could not determine the origin of the espionage attack.

Explicit Financial Motives Decline in 2022

Notably, there was a decrease in the proportion of zero-day vulnerabilities exploited as part of financially motivated operations in 2022.

Exploiting n-day vulnerabilities, which have already been patched, is one of the most common vectors used to transmit ransomware and extortion attacks, as observed in Mandiant Incident Response and Managed Defense investigations.

In order for this decline to have occurred, there may have been a number of factors contributing to it. A significant number of zero-day exploits, including extortion campaigns utilizing four Accellion FTA vulnerabilities simultaneously, occurred in 2021. It was an exceptional year for zero-day exploits across the board.

Most Exploited Vendors & Product Type

Three large vendors, whose technology is widely adopted worldwide and whose distribution mirrors previous years, were disproportionately affected by zero-day vulnerabilities in 2022.

Some threat actors may have targeted unique vendors or niche products based on specific targets or victims of interest. Those technologies were especially useful as attack vectors for those particular targets.

Among the most exploited products were:-

  • Operating systems (19)
  • Browsers (11)
  • Security, IT, and network management products (10)

15 zero-day exploits have been identified in Windows, most of which target the desktop operating system in 2022.

Mitigations

Since zero-day vulnerabilities don’t exist, the patches protecting systems against them can be difficult. However, organizations can take steps to mitigate their impact:-

  • When exposing internal devices to the internet, implement IP-based allow lists if necessary.
  • Instead of exposing your servers to the internet, use private tunnels or VPNs to access them.
  • To maintain the principle of least privilege, it is advisable that the user’s access rights are restricted as much as necessary.
  • Segment your network in the case of a breach to reduce the attack’s spread.
  • It is imperative to monitor your network.
  • Make sure to install firewalls.
  • Ensure the use of e-mail and web filtering products.
  • Always make sure that your endpoints are secure.

It is imperative to properly configure Microsoft, Google, and Apple products, including network segmentation and least privilege policies since they are the most exploited vendors.

During the first quarter of 2023, it has been estimated that the number of Russian cyber threats had increased by 50%, primarily targeting Ukrainian civilian and military assets and those of its partners.

Building Your Malware Defense Strategy – Download Free E-Book

Related Read

Website

Latest articles

mSpy Data Breach: Millions of Customers’ Data Exposed

mSpy, a widely used phone spyware application, has suffered a significant data breach, exposing...

Advance Auto Parts Cyber Attack: Over 2 Million Users Data Exposed

RALEIGH, NC—Advance Stores Company, Incorporated, a prominent commercial entity in the automotive industry, has...

Hackers Using ClickFix Social Engineering Tactics to Deploy Malware

Cybersecurity researchers at McAfee Labs have uncovered a sophisticated new method of malware delivery,...

Coyote Banking Trojan Attacking Windows Users To Steal Login Details

Hackers use Banking Trojans to steal sensitive financial information. These Trojans can also intercept...

Hackers Created 700+ Fake Domains to Sell Olympic Games Tickets

As the world eagerly anticipates the Olympic Games Paris 2024, a cybersecurity threat has...

Japanese Space Agency Spotted zero-day via Microsoft 365 Services

The Japan Aerospace Exploration Agency (JAXA) has revealed details of a cybersecurity incident that...

Top 10 Active Directory Management Tools – 2024

Active Directory Management Tools are essential for IT administrators to manage and secure Active...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles