Zero-Day Exploits: How They Work and Why They’re So Dangerous

March 11, 2025

Cybersecurity might as well have its own language. There are so many acronyms, terms, sayings that cybersecurity professionals and threat actors both use that unless you are deeply knowledgeable, have experience in the security field or have a keen interest, one may not know. Understanding what these acronyms and terms mean is the first step to developing a thorough understanding of cybersecurity and in turn better protecting yourself, clients, and employees.

In this blog series, we aim to explain and simplify some of the most commonly used terms. Previously, we have covered bullet proof hosting, CVEs, APIs, and brute force attacks. In this edition, we dive into Zero-Day exploits.

Zero-Day Vulnerabilities

Zero-day vulnerabilities are software flaws that remain unknown to the vendor and the general IT community. Because the flaws are unknown to the public, there’s no fix available, and they become highly valuable to bad actors and nation states. With these flaws’ cybercriminals, spies, and nation-states have the unfettered opportunity to cause real damage, infiltrate networks, steal data, or cause disruption. Victims of zero-days will remain completely defenseless until the flaw is discovered and remediated.

Just last November, Microsoft released its November Patch Tuesday updates, detailing 89 security flaws. Among these were four newly revealed zero-day vulnerabilities—two of which attackers were already exploiting in the wild. For instance, one zero-day allowed malicious actors to capture password hashes. CVE-2024-43451 is described by Microsoft as a zero-day which requires very little user interaction to expose a user’s password. Single clicking or right clicking to inspect a file is enough to extract a user’s password hash.

This month’s Patch Tuesday is an example of how frequent, common, and severe zero-days are today. But many go unnoticed for months or years before they are patched and remediated. This leaves bad actors ample time to take advantage of holes within networks, gather sensitive data, and carry out cybercrime. Far from a theoretical concern, zero-days have become a fundamental part of modern cybersecurity warfare, underscoring the need for robust defense strategies, responsible disclosure policies, and a deeper understanding of how to limit our exposure to them.

Prominent Zero-Day Attacks

The WannaCry ransomware attack in May 2017 highlights the destructive potential of a zero-day exploit falling into the wrong hands. It leveraged “EternalBlue,” a powerful vulnerability initially developed by the NSA. After this zero-day exploit leaked to the public, malicious actors bundled it into WannaCry, creating a worm-like ransomware that spread to defenseless victims. Within a single day, it infected over 200,000 computers across more than 150 countries, disrupting critical operations at major organizations like FedEx and Honda, and paralyzing parts of the UK’s National Health Service. Luckily, a security researcher discovered a “kill switch” in the code that stopped the virus from infecting more victims. Many victims, running outdated and unpatched Windows systems had to decide whether to pay the ransom or suffer a major loss in data and revenue. WannaCry’s success demonstrated how a stolen zero-day exploit can trigger a global cyber crisis.

The WannaCry case raised concerns among cyber security professionals and Microsoft, who pointed out the US government was hoarding and secretly cataloging dangerous zero-day exploits that the company could have patched, had they been informed of the security flaws.

In late September 2023, Apple issued emergency patches addressing three zero-day vulnerabilities (CVE-2023-41992, CVE-2023-41991, and CVE-2023-41993) in iPhones and iPads. Researchers at Citizen Lab and Google’s Threat Analysis Group say these flaws could allow attackers to bypass signature validation, elevate privileges, and achieve remote code execution. Citizen Lab’s research linked these zero-days to an exploit chain used by Cytrox’s Predator spyware. The spyware was used against at least one high-profile target, a former Egyptian parliament member who had plans to run for president.

Stuxnet represents one of the most sophisticated uses of zero-day vulnerabilities in a real-world (not just theoretical). Discovered in 2010, this worm targeted Iran’s nuclear enrichment facilities by secretly infiltrating their systems. Once inside, Stuxnet exploited multiple zero-day Windows flaws to gain control of industrial control systems. By manipulating the speed of uranium-enriching centrifuges, the malicious code was able to physically degrade the centrifuges, causing the Iranian nuclear program to suffer constant failure. Its complexity and reliance on unpatched vulnerabilities made it a groundbreaking cyberweapon. Stuxnet’s impact extended far beyond Iran, this watershed moment in cyber security put a spotlight on the capabilities cyber weapons could have in cold and hot wars.

Bug Bounty Programs and Zero-Day Brokers

In today’s cyber-driven economy, a niche market has emerged around zero-day vulnerabilities. Recognizing the value of discovering these previously unknown flaws, many organizations now offer financial incentives to researchers who report them responsibly. These are known as “responsible disclosure” or “Bug Bounty Programs”. The amount of the reward often scales with the seriousness of the vulnerability. By inviting a global network of skilled researchers to examine their websites and infrastructure, companies can more quickly identify and fix security gaps. This approach isn’t limited to private enterprises, either; the U.S. government, including the Department of Defense and various other federal agencies, has also embraced bug bounty programs to bolster their cybersecurity defenses.

Zero-day brokers also offer substantial payouts for undiscovered security weaknesses, typically far exceeding a bug bounty. These brokers could be legitimate companies, or an underground network of cyber criminals. Either way, they have no interest in reporting the software flaw to the vendor. Instead, brokers profit by selling these unpatched vulnerabilities to well-funded entities, often government agencies, seeking to compromise targets undetected. To maintain secrecy, researchers who find these bugs must sign strict non-disclosure agreements, agreeing not to alert anyone while the broker seeks the highest bidder. In some cases, brokers may merge multiple zero-days into a single, powerful cyber weapon. This approach led Israeli-based Pegasus to dominate the mobile spyware market, as the company packaged a suite of zero-day exploits into spyware advanced enough to attract government entities throughout the world.

Industry Response and Defense

Mitigating zero-day attacks is challenging because these security gaps are unknown until they’re uncovered. Still, companies, organizations, and individual consumers can take measures to reduce their susceptibility. As a consumer, one of the most effective steps you can take is to install software updates as soon as they’re released. While zero-day vulnerabilities are initially unknown, once identified and patched, they no longer pose the same threat. Keeping your software current helps close these security gaps. For example, victims of the WannaCry ransomware had a month to apply Microsoft’s available patch for the EternalBlue zero-day, which would have protected their systems from the attack.

Organizations also need to be proactive if they want to decrease the likelihood of zero-day exploits affecting their networks and infrastructure. Since it’s impossible to write code that’s entirely immune to hidden vulnerabilities, embracing robust security measures is essential. Regular participation in bug bounty programs, comprehensive penetration testing, thorough code reviews, and responsible disclosure practices can all lower the risk of being compromised by simpler cyber-attacks and code flaws.