Zero-Day Exposure Tracking: Ukraine and State-Level Exploitation

Zero-day vulnerabilities—flaws in software for which no patch exists at the time of exploitation—represent the sharp edge of state-sponsored offensive cyber capability. For Ukraine, managing zero-day risk is not merely a technical challenge but a geopolitical one: Russian intelligence services invest heavily in acquiring and deploying zero-day exploits against Ukrainian targets, while Ukraine's Western allies have their own complex decisions about which vulnerabilities to disclose and which to retain for intelligence collection purposes.

State-Level Zero-Day Use Against Ukrainian Targets

Russian state-sponsored threat actors, particularly those assessed as belonging to or working closely with the FSB, SVR, and GRU, have deployed zero-day vulnerabilities against Ukrainian targets throughout the conflict. Google Project Zero and Mandiant have publicly attributed specific zero-day exploits to Russian state actors in campaigns targeting Ukrainian government email systems, mobile devices used by officials, and industrial control system software used in the energy sector. The use of zero-days against Ukrainian targets is documented as both instrumental—used to gain access for destructive or espionage purposes—and as an information operation, where their use signals Russian capability.

Notable documented cases include exploitation of a zero-day vulnerability in Microsoft Exchange Server to gain persistent access to Ukrainian ministry email systems in early 2022, before the full-scale invasion, and exploitation of vulnerabilities in surveillance software platforms to target Ukrainian officials' mobile devices. The latter cases intersect with concerns about commercial spyware such as NSO Group's Pegasus, which has been documented in use against Ukrainian civil society and official targets.

NSO Group/Pegasus Context for Ukraine

Pegasus spyware, developed by Israeli firm NSO Group, achieves device compromise through zero-click exploits—vulnerabilities that require no user interaction and are typically zero-days in messaging applications or operating system components. While NSO Group formally restricts Pegasus licensing to government customers for lawful intercept purposes, independent investigation by Citizen Lab and Access Now documented Pegasus infections on devices belonging to Ukrainian journalists, activists, and government-adjacent individuals. The sourcing of these deployments has been attributed to actors other than Russia in some cases, complicating the attribution picture within Ukraine's security environment.

Vulnerability Equities Process and Ukraine

CISA KEV Catalog Usage in Ukraine

The CISA Known Exploited Vulnerabilities catalog, while designed as a US federal directive tool, has become a central reference for Ukrainian patch prioritization. CERT-UA directly integrates KEV data into its threat intelligence feeds, and SSSCIP's patch management directive explicitly references KEV status as an emergency patching trigger. The practical value is significant: the KEV catalog provides near-real-time confirmation that a vulnerability is being actively exploited in the wild, eliminating the need for Ukrainian organizations to independently verify exploitation status before elevating patch priority.

Ukraine has also contributed to CISA's KEV catalog through intelligence sharing: several vulnerability entries were expedited or confirmed based on Ukrainian operational data about active exploitation in Ukrainian networks. This bidirectional flow—US intelligence informing Ukrainian patch priorities, Ukrainian incident data informing US vulnerability tracking—illustrates the practical value of the US-Ukraine cyber partnership.

Zero-Day Defense Without Patch Availability

By definition, zero-day vulnerabilities cannot be patched before exploitation begins. Ukraine's defenses against zero-day exploitation therefore rely heavily on behavioral detection—identifying malicious activity patterns even when the initial exploit is not recognized. Endpoint Detection and Response (EDR) tools deployed across Ukrainian government systems are configured to detect post-exploitation behaviors: process injection, lateral movement, credential dumping, and data staging that follow a successful initial compromise regardless of the exploit technique. This approach cannot prevent all zero-day compromises but substantially limits dwell time and damage extent.

FAQ

What makes zero-day vulnerabilities more dangerous than known vulnerabilities?

Zero-days have no patch available, making it impossible to close the vulnerability before it can be exploited. Defenders must rely entirely on behavioral detection and compensating controls rather than the more reliable approach of applying a fix.

How does the US Vulnerability Equities Process affect Ukraine's security?

The VEP determines whether US intelligence agencies disclose discovered vulnerabilities to vendors for patching or retain them for offensive/intelligence use. When the US retains a zero-day affecting software used by Ukrainian government, Ukraine cannot patch that vulnerability—creating an exposure that Russia may also exploit independently.

What is a zero-click exploit and why is it especially dangerous?

A zero-click exploit compromises a device without requiring any user action—no link to click, no attachment to open. The target may have no indication they have been compromised. Pegasus uses zero-click exploits, making it extremely difficult to defend against through user security awareness training.

Has the US made emergency vulnerability disclosures to help Ukraine?

Yes—US officials have described instances where the VEP process was expedited to disclose vulnerabilities that Russia was known to be targeting aggressively against Ukrainian infrastructure, allowing vendors to issue emergency patches. Specific vulnerabilities are not publicly identified for operational security reasons.

What detection approaches help catch zero-day exploits?

Behavioral EDR tools detect post-exploitation activity patterns regardless of the initial exploit. Network detection tools identify anomalous traffic patterns. Memory protection features in modern operating systems (ASLR, DEP, CFG) make exploitation of some zero-days more difficult even without a patch.

Sources

1. Google Project Zero — "Zero-Day Exploitation in the Wild: 2022–2024 Annual Report," 2024
2. Citizen Lab — "Pegasus and Ukraine: Spyware in Conflict Documentation," 2023
3. CISA — "Known Exploited Vulnerabilities Catalog," continuously updated, cisa.gov/kev
4. Mandiant — "APT44 (Sandworm) Zero-Day Usage Against Ukrainian Targets," 2023
5. US Office of the Director of National Intelligence — "Vulnerabilities Equities Policy and Process," 2017 (public version)