Microsoft, Google and Apple zero-days were a huge security threat in 2022
Operating systems, browsers, and networking solutions hosted most of the zero-days
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
When hackers look for zero-day flaws to exploit and gain a foothold on the targetendpoint, they usually look at eitherMicrosoft,Google, orAppleproducts, according to a new report from cybersecurity researchers Mandiant which claims of the major zero-day vulnerabilities were exploited last year, most targeted the big three.
Zero-days are flaws that have not yet been discovered by security researchers, hence IT teams have had zero days to patch their systems up. As such, they’re every hacker’s most prizer possession as abusing it triggers no alarms.
Of all the possible products that could have been targeted, crooks were keeping their magnifying glasses tightly focused onoperating systems, web browsers, and network management products. Windows has had 15 vulnerabilities exploited, Chrome nine, and iOS five. MacOS rounds off the top four with four zero-day vulnerabilities exploited.
Chinese activity
Breaking the findings down geographically, Mandiant says the majority of the zero-days were exploited by Chinese state-sponsored threat actors (7), followed by the Russians (2 - one overlapping), and North Koreans (2). For three, an origin could not be established. Thirteen were exploited by cyber-espionage groups.
Usually, they would look for flaws that would enable them to gain elevated privileges, or run remote code on vulnerable devices (53 out of 55 flaws).
Windows, Chrome and Firefox zero-days exploited to spread malware>More Microsoft Exchange zero-days exploited in the wild>Here are the best malware removal tools today
Between edge infrastructure and cloud services, crooks were mostly interested in the former, as these products usually lack proper cybersecurity defences and are more likely to be compromised without alerting the IT teams. At the same time, as more firms migrate to the cloud, the number of disclosed zero-days might shrink, as cloud service providers report security incidents differently, Mandiant claims.
In any case, 2022 had fewer disclosed zero-day flaws (55) compared to the year prior (80), and while that does sound positive, 2022 was a record-breaker when it comes to the number of zero-days actively exploited. The researchers believe that the trend is only going to get worse this year.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Via:BleepingComputer
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
Is it still worth using Proton VPN Free?
Don’t search for information on cats at work — you could be at risk of being hacked
Washington state court systems taken offline following cyberattack
