Cyber spies, not cyber criminals, behind most zero-day exploitation

Threat actors operating at the behest of government backers are significantly more likely to be behind the exploitation of newly disclosed zero-day vulnerabilities than financially motivated cyber criminals, according to analysis jointly produced by Google’s Threat Analysis Group (TAG) and Google Cloud’s Mandiant.

TAG and Mandiant observed 97 zero-days exploited in the wild during the course of 2023, up from 62 in 2022, but fewer than the 106 observed in 2021.

The analysts said that of the 58 zero-days for which they could attribute the threat actor’s motivations, 48 of them were attributable to government-backed advanced persistent threat (APT) groups conducting espionage activities, while only 10 were attributable to financially motivated cyber criminals, generally ransomware gangs.

Among the four major state hacking operations perceived as hostile to the UK, US and other Western countries – China, Iran, North Korea and Russia – it was Chinese operators who led the way, exploiting almost double the number of zero-days last year than they did in 2022, and accounting for a little over 40% of all attributable exploitation.

Google’s warning over Chinese cyber activity comes just days after the British and American governments sanctioned multiple entities, and issued new warnings over the targeting of politicians and businesses by Chinese hackers intending to steal state secrets and intellectual property.

Its findings suggest that when prioritising response to vulnerability disclosures, those organisations considered more at risk of malicious state interference, such as government bodies, universities and research institutions, and operators of critical national infrastructure (CNI), should pay particularly close attention.

“Consistent with the two preceding years, we attributed more government-backed exploitation of zero-day vulnerabilities to PRC [People’s Republic of China] government-backed attackers than any other state,” wrote the report’s authors, Maddie Stone, Jared Semrau and James Sadowski.

“Mandiant reported extensively on several widespread exploitation campaigns, including UNC4841’s exploitation of two vulnerabilities in Barracuda’s Email Security Gateway – CVE-2023-2868 and CVE-2023-7102.

“The actor showed specific interest in information of political or strategic interest to the PRC government, targeting global governments and organisations in high-priority industries,” they said. “Further, we observed specific interest in email domains and users from Ministries of Foreign Affairs of ASEAN member nations, as well as individuals within foreign trade offices and academic research organisations in Taiwan and Hong Kong.”

Other zero-days of particular interest to Chinese cyber spies in recent months have included CVE-2022-41328 in Fortinet FortiOS, which was chained with a VMware authentication bypass vulnerability, CVE-2023-20867, by a group tracked by Mandiant as UNC3886. UNC3886 also heavily exploited another VMware issue, CVE-2023-34048, as a precursor to exploiting the authentication bypass flaw.

Stone, Semrau and Sadowski noted that in both instances, exploitation of the two vulnerability chains dated back well over 12 months – and to 2021 in the second case – demonstrating how Chinese threat actors are highly adept both at discovering and exploiting new zero-days, and successfully keeping them under wraps for a significant length of time.

The focus on China should not distract from the activities of Russian and North Korean cyber espionage activity – which was not insignificant – and 2023 was also notable for the emergence of a Belarusian APT group, known as Winter Vivern. This is the first time a Belarusian actor has been observed using zero-days, although given Belarus is essentially a vassal state of Russia, it’s hard to state to what degree Winter Vivern is operating independently.

Looking to financially motivated cyber crime, which accounted for 17% of zero-day exploitation – lower than in 2022 – one group, FIN11, accounted for almost a third of the financially motivated exploitation seen last year, having invested heavily in zero-days over a number of years.

FIN11 is linked to multiple prolific ransomware operations, notably Clop/Cl0p and related, antecedent operators, but other gangs, including Akira, LockBit and Nokoyawa, are also – or have been – heavily involved in zero-day exploitation.

“Given the extensive resources invested into identifying and exploiting zero-day vulnerabilities, financially motivated threat actors highly likely prioritise the use of vulnerabilities that provide efficient access to targeted organisations,” wrote Stone, Semrau and Sadowski.

“FIN11 has focused heavily on file transfer applications which provide efficient and effective access to sensitive victim data without the need for lateral network movement, streamlining the steps for exfiltration and monetisation,” they said. “Subsequently, the large revenues generated from mass extortion or ransomware campaigns likely fuels additional investment by these groups in new vulnerabilities.”