The Zero Day Landscape, Tycoon 2FA Disruption, and KEVology

So the Google Threat Intelligence Report that I mentioned is an annual report that Google puts out. Just really intense deep dive into the zero day landscape. I don't want to dig into the argument or debate about what is a zero day and what's not. And that whole semantic debate. I've spent 25 years doing that, honestly, and I don't really want to do it anymore. So we're just getting, we're just going to talk about the report.

In 2025, Google observed 90 individuals 0 days exploited in the wild. So that's a pretty large number. I mean, to give you some context, the large, the highest number that Google has seen since they've been doing this is 100 in 2023. In 20/24 it was 78. So it's down from the the all time high, but it's up a decent amount from the previous year and it's still kind of in this historic range of about 60 to 100 that that you've seen in the last four years. And you know, there's a lot of variables that can, they can sort of affect how many zero days end up being exploited in the wild, or I should say being seen exploited in the wild, being noticed or detected, exploited in the wild. That's different than actually

being exploited in the wild because there's probably some unknowable number of 0 days that are exploited each year that aren't detected or aren't detected until much later, or aren't publicly disclosed as being detected for various reasons. Because they might have been used by a friendly intelligence agency or an intelligence agency was the one that detected it and doesn't want to disclose it for various reasons. Anyway, the interesting thing from this year's report from Google is that the group or the type of groups that are exploiting the most 0 days in 2025 was the absolutely horrific commercial spy Ware vendor organizations. We've talked about that sector of the landscape before on this podcast and if you're not

familiar with it, you can go and read any of the reports from Citizen Lab or Google itself or other threat intelligence groups that track these organizations. These are commercial companies that sell would amount to exploit kits to to customers often. Typically those customers are law enforcement agencies and I guess sometimes intelligence agencies and other government entities.

That's what they portray themselves as selling these kits to or these tools to. If you want to dig into this and really depress yourself, you can go and see who some of the other organizations that they that historically have bought and used these exploit kits are. And I don't think it'll surprise anybody that's listening to this podcast. Anyway. This was the first year that Google saw more 0 days exploited by commercial spyware vendors than by cyber espionage groups. So out of the 42 zero days that targeted enterprise technologies in 2025, 18 were attributed to commercial spyware vendors in 15 were linked to cyber espionage groups, state linked groups. So you can think about, you

know, the Typhoons and the the Cozy Bears and those sorts of groups of the world, you know, the the big hitters on the cyber espionage landscape. It's an interesting and I think an important change in the landscape. I'm not sure if it's a permanent change or just sort of a one off anomaly, but there's been a lot of public focus on these cyber espionage groups over the last few years. You know, as I mentioned, Citizen Lab studies them intently and is often part of the disclosure of new zero days that are being exploited by these organizations.

Often those are in Android or iOS. That's not what this specific number entails. This 18 number of 0 days exploited by the commercial spyware vendors last year are in enterprise technology. So, you know, you're talking about, you know, edge security devices, you know, Microsoft software, things like that, that enterprises deploy all the time. So there's a lot of there's a lot of attack surface there and there's even even with the the public focus on these commercial spyware vendors, they are not slowing down. If anything, it seems like they're gaining momentum in some places.

Most of these spyware vendors are located in in, you know, non-us countries outside the US borders. But there have been some recorded instances where US entities have have done business with these companies. So that's something everybody should be aware of. As I mentioned that we have a story up on this Google report on the site. It's got some links to some of the Citizen Lab reports. A couple of the, the major probably most well known companies that are involved in this are Intellectsa and NSO Group.

You've probably heard of the Predator, Predator or Pegasus spyware tools. There's plenty of other commercial spyware vendors out there. Some of them are very small and they also seem to operate in that Gray area of, you know, they'll get to a certain size and then some of their tools will get exposed or their business model falls apart for whatever reason. And then they'll kind of dissipate and reform under a different name, but probably with the same people and some of the same tools. It's that it's an odd portion of the threat landscape, but it's it's a really disturbing and fascinating one if you want to look into it.

So I'd encourage you all to get to go and read the story and also dig into Google's report on that. It's, it's got all the details you could want. It's got the historical data and some really important takeaways from it. So it's something everybody should go take a look at, regardless of how, how much you know or don't know about that landscape. It's, it's always interesting to see what Google's, Google's perspective on this is because you know, sometimes you'll see these, these annual reports and they have, you know, some eye popping or, you know, headline grabbing numbers.

And then you dig into it a little more and you're like, oh, OK, this is, you know, this is interesting, but it's from a limited subset of enterprise customers or it's only in certain geographies or something like that. Google obviously has a extremely broad lens on the Internet. So their numbers tend to, you know, their data points tend to be pretty legit. Another interesting story that we covered this week was cybercrime operation or cybercrime disruption operation that Microsoft LED along with Europol and some other technology partners going after the Tycoon 2FA cybercrime operation, which as you can guess by the name specifically targeted or specifically, you know, work to get around to FA protections on accounts and you

know, was pretty successful in that. And the operation was very, very large. Microsoft estimated that it accounted for 62% of all of the phishing attempts that Microsoft blocked by the middle of last year, including more than 30 million emails in one month, which is a completely insane number. You know, anybody that's been on the Internet for any, you know, significant amount of time understands how large the phishing problem is. Like, I mean, you probably get some number of phishing emails everyday depending on how good your spam filters are at work or in your your personal e-mail account. But 30 million phishing emails being blocked in one month from this specific operation is pretty large. And Microsoft linked this operation to approximately 96,000 phishing victims across

the world since 2023. So this operation is, you know, I guess about 2 1/2 years old, which in Internet terms is, you know, relatively old. These things tend not to last very long because law enforcement or Microsoft or Google or someone else takes notice and goes and kicks the door down and and takes down their infrastructure. Easy for me to say. Or something along those lines.

And so like the commercial spyware vendors, a lot of times these things pop up getting gain a lot of momentum and then quickly grab too much attention and end up either being dismantled by law enforcement or they the operators take them down themselves. And you know, often reconstitute them in some other form so that they can start a new without all the attention from the threat intelligence community and the law enforcement community. So this Tycoon 2FA platform was a big problem and it's always nice to see these disruption operations. We we tend to cover them a lot just because it's it's good to see good news every once in a while. You know, especially the way things are going right now in the general world and also in the security world, you can really get yourself down a dark rabbit hole if you just start reading vulnerability reports

and attack reports everyday. That's not a good place to be, I can tell you. But it's nice to see some good news every once in a while and it's always nice to see these takedown operations be successful. So the third thing I wanted to mention, I mentioned it at the top, the conversation I had with Todd Beardsley from Run Zero on the podcast that went up earlier this week. It's a, it's a pretty long podcast that we did on this report that Todd wrote. It's called Kevology Kev being the known exploited vulnerabilities catalog that Sisa maintains. And for those that don't know, Todd is a long time security researcher.

You know, he worked at at Rapid seven. He was a big part of the Metasploit project, and he also was the section chief for the Kev catalog at SISA for a while. So he knows about as much of about this world as anybody does. And he wrote this report that looks at the Kev catalog in context in various different ways. It's kind of hard to explain exactly what he did. He also wrote a tool, a web app called the Kev Collider that lets you sort of remix the data and filter it from Sysis Kev catalog in various different ways so that you can look for trends, but also specific to your infrastructure and in the the apps and products that you really care about. So the, the conversation I had with Todd was really entertaining.

It's believe me, it is not dry. Todd's a really funny guy and has a lot of he's not afraid to say what he thinks, which is always refreshing. Those are the, the people we love having on the podcast. And the, the way that this Kevology report came about, as Todd mentioned on the podcast, is that Run Zero had a customer that said, hey, is there a way for you to just show us all of the, the coverage for every vulnerability in the cab catalog?

And he kind of looked at that and said, sure, that would be great, but let me dig into it and I'll let you know. And so he ended up writing a 20,000 word paper on why it's really difficult to do that. And in our podcast, he, he says getting 100% Kev coverage today is, I would pause it impossible, certainly with one solution. And he went on to say, I don't have the exact quote, but he said, if there's a software vendor that tells you that they can give you 100% coverage of the Kev catalog with one click, they're lying.

So don't don't take all of that with a grain of salt when you're talking to these vendors. You know, the Kev catalog is really important as a resource. It's a great reference point to know which vulnerabilities have been exploited in the wild when they've been exploited, you know, especially relative to when they were disclosed. So, you know, if there is some Microsoft Office bug that was disclosed in last July's Patch Tuesday release, but then all of a sudden you see it pop up in the Kev catalog this month, you know, eight months later, you tend to ask why, like, what was the delta?

Why are, why are attackers only now paying attention to it? Or why are we only now detecting that exploitation? So that's kind of the the gist of what Todd and I talked about and what the Kevology report is about. There's links to the report and the Kev Collider tool in that podcast episode so y'all should go listen to that Todd. Not for me but Todd's really funny. We also talked about this completely insane non security non technology podcast that Todd does.

We talked about this right at the beginning of our discussion where he is reading more and Peace one sentence at a time on a podcast. That's not, I did not misspeak, that's what he is doing. So he's doing essentially like 6 to 8 to 10 second episodes every day of this podcast called War in Pieces, which is just absolutely incredible. And I'd like most people. I tried to read War and Peace at one point in my life and probably made it, I don't know, maybe 30 pages or something. And I read a lot of books, but I did not get through that. But Todd is reading it one sentence at a time. So if that's your jam, go listen to Todd's podcast. That thing, I mean, it sounds absolutely wild. And he's got a couple of other ones that are pretty funny too. So go have a listen to all of that stuff. And we've got some other really fun podcast conversations that we've already recorded and a

couple more that are on the way. And we'll have an RSA preview. Podcast to RSA is 3 weeks away as we're recording this. So if you're one of the unfortunate souls that has to go to RSA, I'm one of them. I'll be there. So if you see me wandering around in a Decipher shirt, come say hi. And that's it for this week guys. Have a good weekend. Talk to you soon.