Spyware Vendors Behind 50% 0-day Exploits: Google Said

Spyware is a crucial tool for the surveillance and data collection of high-risk individuals. The functionalities of spyware have undergone significant advancements and have become more sophisticated than ever before.

Commercial surveillance vendors (CSVs) offer state-of-the-art spyware technology to governments and private companies, which can exploit security vulnerabilities to surveil individuals.

CSVs pose a significant threat to Google users, as half of all known 0-day exploits against Google products and Android devices can be attributed to them.

CSVs Behind 50% of 0-day Exploits

Google has recently published a comprehensive report that meticulously outlines 40 companies involved in spyware development, sales, and deployment. The report offers detailed insights into the practices of these entities and their contribution to the spyware industry.

Google has discovered that several less popular CSVs were crucial in developing highly advanced spyware.

The use of spyware by governments is becoming outdated as the private sector is now leading in the development of highly advanced tools. Google Threat Analysis Group has identified that many of these sophisticated tools are now being created by the private sector.

In 2023, the Threat Analysis Group (TAG) uncovered 25 zero-day vulnerabilities being exploited in the wild. Out of these, 20 zero-days were exploited by CSVs.

In the initial quarter of 2024, 72 zero-day vulnerabilities have been identified in Google products that are being actively exploited. Of these 72 vulnerabilities, 35 are linked to Comma Separated Values (CSVs).

CSVs Highligted by Google

Cy4Gate and RCS Lab: Founded in Italy in 2014, it is known for developing “Epeius” spyware targeting Android and iOS systems.

Intellexa: Founded in Cyprus in 2019, known for developing “predator” spyware targeting Android and iOS systems

Negg Group: Founded in Italy in 2013, it is known for developing “Skygofree” spyware targeting Android & Windows systems.

NSO Group: one of the highest-profile CSVs, operating from Israel, known for its Pegasus spyware targeting Android and iOS systems.

Variation: Founded in Spain in 2018, it is known for developing “Heliconia framework” spyware targeting Chrome, Android, iOS, Firefox, and Microsoft Defender.

Google is heavily investing in enhancing its threat detection and defense capabilities. The primary focus is to rapidly detect and disrupt existing cyber operations, thereby making it arduous for attackers to regroup and launch new attacks.

Google implements cutting-edge security features and measures across all its products to ensure the safety and security of its users. These measures are industry-leading and designed to protect users against potential threats.

Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.