Listen to this Post
Cyber threat actors are continuously exploiting a wide range of vulnerabilities, targeting systems that are years or even decades old. These vulnerabilities remain a persistent threat to organizations and individuals alike. According to the GreyNoise 2025 Mass Internet Exploitation Report, cybercriminals are exploiting everything from recently discovered flaws to legacy vulnerabilities that have been left unpatched for years. Understanding the trend in exploitation speeds, the types of vulnerabilities most commonly targeted, and the motives behind these attacks can help organizations better prepare for the next wave of cyber threats.
Key Findings from the 2025 Mass Internet Exploitation Report
The 2025 Mass Internet Exploitation Report by GreyNoise, released on February 27, 2025, provides an in-depth look at the vulnerabilities most exploited in 2024. One striking revelation was the long lifespan of many of the exploited vulnerabilities. Nearly 40% of the vulnerabilities leveraged by cybercriminals in 2024 were from 2020 or earlier. In fact, 10% of the exploited flaws dated back to 2016 or earlier, with some flaws even originating from as far back as the late 1990s, such as the CVE-1999-0526 X server vulnerability.
Legacy vulnerabilities such as CVE-2018-10-561, found in Dasan GPON home routers, also continued to be a favorite target for attackers, despite being discovered several years ago. While many attackers are still exploiting these older vulnerabilities, the speed at which they exploit newly disclosed flaws is increasing. In 2024, exploitation of newly discovered CVEs occurred within hours of disclosure in some cases. Additionally, 29 vulnerabilities were exploited before they were even added to the US Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) catalog.
Ransomware groups were identified as the primary perpetrators of these attacks, using a significant portion of the vulnerabilities added to CISA’s KEV catalog to further their objectives. The attackers’ main aims included expanding botnets, cryptocurrency mining, gaining initial access for ransomware deployment, exfiltrating data, and creating proxy services for additional attacks.
What Undercode Says: Analyzing the Exploitation Trends
The findings in the GreyNoise report illustrate an alarming trend where cybercriminals are targeting both new and legacy vulnerabilities with increasing sophistication. The dual nature of these exploits – attacking both old and newly discovered flaws – demonstrates how cybercriminals are taking advantage of gaps in both security patching and rapid exploitation of new vulnerabilities.
A primary concern is the exploitation of older vulnerabilities, especially those that have been publicly known for years. The persistence of these flaws, such as CVE-1999-0526, highlights the failure of many organizations to implement timely security updates and patches. Even after decades, these flaws continue to provide attackers with a viable entry point into systems. This pattern is especially concerning for critical infrastructure, where outdated software and hardware are often overlooked or maintained at a minimal level.
On the other hand, the rapid exploitation of newly disclosed vulnerabilities shows how attackers are continuously adapting their methods to exploit vulnerabilities faster than ever before. In some cases, attacks are launched within hours of vulnerabilities being made public. This speed of exploitation further emphasizes the need for organizations to be more proactive in responding to vulnerability disclosures.
The increasing prevalence of attacks targeting home routers and fiber modems is particularly concerning, as these devices are used by millions of consumers and businesses alike. With vulnerabilities present in widely used systems from Ivanti, D-Link, and VMware, attackers can easily expand their botnets, engage in cryptocurrency mining, and even launch ransomware attacks or steal sensitive data. These threats are further compounded by the increasing sophistication of ransomware groups, which have developed complex attack chains that enable them to quickly breach systems and cause significant damage.
Another noteworthy point is the use of proxy services. Attackers are increasingly leveraging compromised systems to create proxy services for further exploitation, allowing them to disguise their true locations and launch attacks on a larger scale. This trend makes it more difficult for cybersecurity teams to trace and mitigate attacks effectively.
Ultimately, the data from GreyNoise’s report suggests that the cybersecurity landscape will continue to be fraught with challenges. As attackers evolve their tactics and tools, it is crucial for organizations to stay ahead of the curve by maintaining robust patch management practices, implementing proactive threat detection, and collaborating with trusted cybersecurity firms to stay informed of the latest threats.
Fact Checker Results
- Older Vulnerabilities Continue to Be Exploited: The report accurately highlights the continued exploitation of vulnerabilities from as far back as the late 1990s, emphasizing the importance of patching legacy systems.
- Speed of Exploitation: The claim that exploitation occurs within hours of disclosure in some cases is substantiated by the data, underlining the urgency for organizations to act quickly.
- Ransomware’s Role: The analysis of ransomware groups leveraging newly disclosed vulnerabilities is consistent with current cybersecurity trends, confirming that ransomware remains a dominant threat.
The insights provided by GreyNoise paint a comprehensive picture of the evolving cyber threat landscape, illustrating both the persistence of legacy vulnerabilities and the increasing speed at which new vulnerabilities are exploited. It is clear that organizations must adopt a proactive, agile approach to cybersecurity to mitigate these threats.
References:
Reported By: https://www.infosecurity-magazine.com/news/old-vulnerabilities-widely/
Extra Source Hub:
https://www.quora.com
Wikipedia: https://www.wikipedia.org
Undercode AI
Image Source:
OpenAI: https://craiyon.com
Undercode AI DI v2
