Google says spyware makers and China-linked groups dominated zero-day attacks last year

Zero-day exploitation targeting enterprise tech products reached an all-time high last year, with China-linked cyber-espionage groups remaining the most prolific state-backed users, according to Google.

Google Threat Intelligence Group tracked 43 zero-days in enterprise software and appliances in 2025, representing 48 percent of all attacks against these previously undisclosed bugs. That's up from 36 (46 percent) in 2024. 

In total, the Chocolate Factory documented 90 zero-day vulnerabilities actively exploited last year, which is more than 2024's number (78), but still not as many as 2023's record high of 100. 

And while end-user product attacks still slightly outpace those targeting enterprise software and appliances, this most recent report is yet another indicator of attackers' shift since 2023 toward exploiting big orgs.

Security and networking devices were the hardest hit, comprising nearly half (21) of the enterprise-related zero-days last year. Google also noted that 14 enterprise tech zero-days in ...