FireEye details how zero-days were exploited worldwide from 2012 to 2019, says it was able to link the use of 55 zero-day exploits to state-sponsored operations
The collection of countries using those secret hacking techniques has expanded far beyond the usual suspects.
Context & Ripple Effects
FireEye's report is the product of years of attribution work: by tracing who deployed each of 55 zero-day exploits between 2012 and 2019 back to state-sponsored operators, it turns what was previously scattered incident response into a single dataset on how governments actually stock and spend their offensive arsenals. The headline finding is breadth — the collection of countries using these techniques has expanded well beyond the traditional major powers.
The arc since then validates the report's framing as a baseline rather than a peak. Mandiant's later overview of 55 zero-days exploited in 2022 alone — mostly in Apple, Microsoft, and Google products, with Chinese groups the most active — shows annual exploitation now matching what FireEye attributed across seven years, while Google's researchers counted 97 zero-days observed in the wild in 2023, up 50% year over year and dominated by espionage actors.
First-order effects
- Defenders and the affected vendors gain a public attribution map: knowing which exploits trace to which states lets network owners prioritize patching and threat hunting against specific national adversaries rather than generic malware.
Second-order effects
- Commercial tracking becomes a competitive discipline — FireEye's dataset sets the template that Google's Project Zero and Mandiant's annual reviews now follow, pressuring every security vendor to publish zero-day telemetry or cede the attribution narrative.
Third-order effects
- As the user base of state-grade exploits widens beyond the usual suspects, the case for formal policy over government stockpiles strengthens — a debate already visible when the US was shown to have used zero-days before it had policies governing them — pushing toward disclosure norms and stockpile-reduction rules.
The trend: State-sponsored zero-day exploitation is broadening from a handful of major powers to a wider set of nations, with commercial researchers turning annual exploit counts into the industry's measuring stick.