How China and North Korea Are Industrializing Zero-Days

A new report from Google Cloud’s Threat Intelligence team highlights a sharp rise in the use of zero-day vulnerabilities by Chinese and North Korean state actors – marking the first time North Korea has matched China in exploit volume.

See Also: How Generative AI Enables Solo Cybercriminals

“There’s a tournament where hackers are competing, and they literally got a list of technologies they want to find vulnerabilities in,” said John Hultquist, chief analyst, Google Threat Intelligence Group, Google Cloud. “Academics are involved, contractors are involved, government and military is involved. It’s a real ecosystem, It’s all designed to find these things and exploit them.”

He also pointed to a growing workforce threat from North Korean operatives posing as remote IT professionals to infiltrate Western companies. “They are literally running into each other in the hiring pipeline. Many are getting good performance reviews,” he said.

In this video interview with Information Security Media Group at RSAC Conference 2025, Hultquist also discussed:

• How threat actors are increasingly exploiting unmonitored edge appliances using zero-day vulnerabilities to access networks;
• How nation states including China and North Korea are using organized ecosystems to find and exploit zero-days at scale;
• The need for cross-functional collaboration between HR and cybersecurity to detect and prevent intrusions.

Hultquist built the cyberespionage intelligence practice at iSIGHT Partners prior to its acquisition by Mandiant. He has more than 20 years of experience in intelligence and special operations, primarily covering emerging threats in cyber espionage. He is also the founder of Cyberwarcon and Sleuthcon and teaches at Johns Hopkins University.