Google’s latest research reveals a concerning trend: the discovery and exploitation of zero-day vulnerabilities in enterprise-specific software and appliances are surging, outpacing the overall leveraging of zero-day bugs. In 2023, Google’s Threat Analysis Group (TAG) and Mandiant division tracked 97 zero-day vulnerabilities exploited by cybercriminals, a significant increase from the previous year’s 62 vulnerabilities—a 56% uplift.

Of particular note is the rise in zero-day vulnerabilities affecting enterprise-specific technology, which increased by 64% in 2023 compared to 2022. This trend has been steadily growing over the past five years, with a notable shift in the types of products targeted for malicious exploitation.

While 61 of the 97 zero-days affected end-user products like mobile devices, operating systems, browsers, and applications, the number of vulnerabilities in this category is not increasing as rapidly as those targeting enterprise counterparts. Notable investments by vendors such as Apple, Google, and Microsoft have contributed to mitigating vulnerabilities in end-user platforms, with protections like Apple’s Lockdown Mode for iOS and Google’s MiraclePtr significantly reducing the prevalence of certain vulnerabilities.

However, the report highlights an increase in zero-days across third-party components and libraries, providing attackers with more opportunities to exploit multiple products with a single vulnerability. For example, vulnerabilities affecting widely used libraries like libvpxin and libwebp have enabled attackers to target multiple platforms and applications simultaneously.

In the realm of enterprise tech, buggy security software and appliances have become prime targets for exploitation. Vendors such as Ivanti, Barracuda, Cisco, and Trend Micro have experienced zero-day exploits targeting their products, highlighting the challenges faced by enterprise vendors in responding to sophisticated attacks effectively.

The report also sheds light on the motivations behind zero-day exploits, with the bulk attributed to commercial surveillance vendors and government cyberspies. Notably, China’s government was identified as the most prolific nation-state attacker, accounting for a significant portion of zero-day exploits in 2023.

Overall, the findings underscore the need for robust cybersecurity measures, proactive patch management, and collaboration between vendors, security researchers, and government agencies to address the evolving threat landscape.