Thursday, December 7, 2023

Hackers Weaponized and Exploited Over 55 Zero-days in Microsoft, Google, and Apple

Mandiant researchers have recently reported that 55 zero-day vulnerabilities were actively exploited in 2022, most against the following brands and their products:-

  • Microsoft
  • Google
  • Apple

Researchers state that hackers are still targeting zero-day vulnerabilities in malicious campaigns. It has been reported that most of these vulnerabilities resulted in the attacker being able to either gain elevated privileges or execute remote code on vulnerable devices.

Zero-days Exploited in 2022

However, it is important to note that compared to recent years, there has been a decline in the overall number and proportion of financially motivated zero-day exploits in 2022.

There were 55 zero-day flaws exploited in 2022; 13 were exploited by cyber-espionage groups, while Chinese cyber spies exploited seven.

Seven zero-day vulnerabilities have been exploited by China so far, making the country the most prolific. And here below, we have mentioned those seven flaws:-

One of the flaws exploited by Russian threat actors overlapped with another two flaws exploited by North Koreans. In three cases, Mandiant could not determine the origin of the espionage attack.

Explicit Financial Motives Decline in 2022

Notably, there was a decrease in the proportion of zero-day vulnerabilities exploited as part of financially motivated operations in 2022.

Exploiting n-day vulnerabilities, which have already been patched, is one of the most common vectors used to transmit ransomware and extortion attacks, as observed in Mandiant Incident Response and Managed Defense investigations.

In order for this decline to have occurred, there may have been a number of factors contributing to it. A significant number of zero-day exploits, including extortion campaigns utilizing four Accellion FTA vulnerabilities simultaneously, occurred in 2021. It was an exceptional year for zero-day exploits across the board.

Most Exploited Vendors & Product Type

Three large vendors, whose technology is widely adopted worldwide and whose distribution mirrors previous years, were disproportionately affected by zero-day vulnerabilities in 2022.

Some threat actors may have targeted unique vendors or niche products based on specific targets or victims of interest. Those technologies were especially useful as attack vectors for those particular targets.

Among the most exploited products were:-

  • Operating systems (19)
  • Browsers (11)
  • Security, IT, and network management products (10)

15 zero-day exploits have been identified in Windows, most of which target the desktop operating system in 2022.


Since zero-day vulnerabilities don’t exist, the patches protecting systems against them can be difficult. However, organizations can take steps to mitigate their impact:-

  • When exposing internal devices to the internet, implement IP-based allow lists if necessary.
  • Instead of exposing your servers to the internet, use private tunnels or VPNs to access them.
  • To maintain the principle of least privilege, it is advisable that the user’s access rights are restricted as much as necessary.
  • Segment your network in the case of a breach to reduce the attack’s spread.
  • It is imperative to monitor your network.
  • Make sure to install firewalls.
  • Ensure the use of e-mail and web filtering products.
  • Always make sure that your endpoints are secure.

It is imperative to properly configure Microsoft, Google, and Apple products, including network segmentation and least privilege policies since they are the most exploited vendors.

During the first quarter of 2023, it has been estimated that the number of Russian cyber threats had increased by 50%, primarily targeting Ukrainian civilian and military assets and those of its partners.

Building Your Malware Defense Strategy – Download Free E-Book

Related Read


Latest articles

Bluetooth keystroke-injection Flaw: A Threat to Apple, Linux & Android Devices

An unauthenticated Bluetooth keystroke-injection vulnerability that affects Android, macOS, and iOS devices has been...

Atlassian Patches RCE Flaw that Affected Multiple Products

Atlassian has been discovered with four new vulnerabilities associated with Remote Code Execution in...

Reflectiz Introduces AI-powered Insights on Top of Its Smart Alerting System

Reflectiz, a cybersecurity company specializing in continuous web threat management, proudly introduces a new...

SLAM Attack Gets Root Password Hash in 30 Seconds

Spectre is a class of speculative execution vulnerabilities in microprocessors that can allow threat...

Akira Ransomware Exploiting Zero-day Flaws For Organization Network Access

The Akira ransomware group, which first appeared in March 2023, has been identified as...

Hackers Deliver AsyncRAT Through Weaponized WSF Script Files

The AsyncRAT malware, which was previously distributed through files with the .chm extension, is now being...

BlueNoroff: New Malware Attacking MacOS Users

Researchers have uncovered a new Trojan-attacking macOS user that is associated with the BlueNoroff APT...

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles