Zero-Day Weaponization: Nation-State Actors Exploit Unpatched Vulnerabilities in North America

Introduction

Zero-day vulnerabilities—flaws in software unknown to the vendor—pose significant risks to cybersecurity. Nation-state actors are increasingly exploiting these vulnerabilities, often through unpatched exploits and exploit broker transactions, to advance their cyber operations.

Exploitation of Zero-Day Vulnerabilities

In 2025, 90 zero-day vulnerabilities were exploited in the wild, with nearly half targeting enterprise-grade technology. State-sponsored groups, particularly those linked to China, have been prominent in exploiting these vulnerabilities, focusing on networking and security tools, especially edge devices lacking robust endpoint detection and response capabilities. (tech.yahoo.com)

Exploit Broker Transactions

Exploit brokers facilitate the acquisition and sale of zero-day vulnerabilities. For instance, in February 2026, the U.S. Department of the Treasury sanctioned Sergey Sergeyevich Zelenyuk and his company, Matrix LLC (doing business as Operation Zero), for acquiring and distributing cyber tools harmful to U.S. national security. Operation Zero has been known to offer substantial rewards for zero-day exploits targeting popular applications. (home.treasury.gov)

In-the-Wild Exploitation

The exploitation of zero-day vulnerabilities in the wild has been a growing concern. In 2025, 32% of exploited vulnerabilities were zero-days or one-days, highlighting the increasing sophistication of cyber threats. (csoonline.com)

Implications for North America

The exploitation of zero-day vulnerabilities by nation-state actors in North America underscores the need for enhanced cybersecurity measures. Organizations must prioritize timely patching of vulnerabilities and remain vigilant against sophisticated cyber threats.

Conclusion

The weaponization of zero-day vulnerabilities by nation-state actors represents a significant challenge to cybersecurity in North America. Continuous monitoring, rapid response to vulnerabilities, and collaboration between public and private sectors are essential to mitigate these threats.