Critical Surge in Zero-Day Exploitation by Nation-State Actors in North America

Executive Summary

In early 2026, nation-state actors, notably from China, have markedly intensified the exploitation of zero-day vulnerabilities within North America. This escalation poses critical threats to national security, critical infrastructure, and private sector entities. The rapid weaponization of previously unknown vulnerabilities underscores the pressing need for enhanced cybersecurity measures and international cooperation.

Current Threat Landscape

Recent reports indicate a significant uptick in zero-day exploits:

• VulnCheck's 2026 State of Exploitation Report: Identified 884 vulnerabilities exploited in the wild for the first time in 2025, a 15% increase from 2024. Notably, 28.96% of these were exploited before or on the day of public disclosure, highlighting a concerning acceleration in exploitation timelines. (infosecurity-magazine.com)

• Google Threat Intelligence Group (GTIG) Report: Tracked 90 zero-day vulnerabilities exploited in 2025, with nearly half targeting enterprise-grade technologies. This marks an all-time high and reflects a strategic shift towards high-value targets. (cybersecuritydive.com)

Notable Exploitation Cases

• 2024 Global Telecommunications Hack: Chinese state-sponsored actors, identified as Salt Typhoon, exploited zero-day vulnerabilities in Versa Director and unpatched Fortinet and Cisco devices to infiltrate major U.S. internet service providers. This breach compromised metadata of over a million users, including high-profile individuals, and wiretapping systems. (en.wikipedia.org)

• Volt Typhoon Campaign: An advanced persistent threat attributed to the Chinese government, Volt Typhoon has been active since at least mid-2021, primarily targeting U.S. critical infrastructure. The group's operations focus on espionage, data theft, and credential access, employing sophisticated techniques to evade detection. (en.wikipedia.org)

Exploit Broker Transactions

The market for zero-day vulnerabilities has seen increased activity, with exploit brokers facilitating transactions between vulnerability discoverers and threat actors. While some brokers claim to sell exploits exclusively to government entities for defensive purposes, the lack of transparency and regulation raises concerns about the potential misuse of these vulnerabilities. The ethical and legal implications of such transactions remain subjects of ongoing debate. (insights.manageengine.com)

Recommendations

• Enhanced Vulnerability Management: Organizations should prioritize rapid patching and implement robust vulnerability management programs to mitigate the risk of zero-day exploitation.

• International Collaboration: Strengthening international cooperation is essential to share threat intelligence and develop coordinated responses to state-sponsored cyber threats.

• Policy Development: Governments should establish clear policies and regulations regarding the sale and use of zero-day vulnerabilities to prevent their exploitation by malicious actors.

Conclusion

The increasing exploitation of zero-day vulnerabilities by nation-state actors in North America presents a critical challenge to cybersecurity. Proactive measures, including improved vulnerability management, international collaboration, and policy development, are imperative to safeguard national security and infrastructure.

Highlights:

• Zero-Day Exploits Surge, 30% of Flaws Attacked Before Disclosure - Infosecurity Magazine, Published on Wednesday, January 21
• Nearly half of exploited zero-day flaws target enterprise-grade technology | Cybersecurity Dive, Published on Thursday, March 05
• 2024 global telecommunications hack