How do black-hat hackers make money from their zero-day exploits?

One method is to come up with some sort of wrapper code that would deliver it. The Angler rootkit, for example, has a history of doing this; last year, it introduced four zero-days as a part of its offering while still constantly refreshing its list of new exploits.

But markets change, and now zero-days will be sold for a profit. Some cybercriminals covet them for their own use, and some brokers will facilitate such a trade.

The Hacking Team decided to test this process. Afterward, Vlad Tsyrklevich conducted an analysis of the emails between the parties, which indicated a high level of distrust between them. It seems that the cybercriminals fear being cheated and as a result won’t often sell their exploits on the underground.

Selling the Exploit

When Trustwave’s SpiderLabs found a zero-day exploit being offered inside a Russian cybercriminal forum, it came as a surprise. The forum in question is usually used as a collaboration platform “where one can hire malware coders, lease an exploit kit, buy web shells for compromised websites or even rent a whole botnet for any purpose,” Trustwave SpiderLabs said.

“However, finding a zero day listed in between these fairly common offerings is definitely an anomaly.”

According to the seller, the zero-day in question is a local privilege escalation (LPE) that works on all current versions of the Windows operating system. It was put on sale at prices above $95,000 and was later reduced to $90,000.

Trustwave asserted it cannot vouch for the claims. While the offer may look real, there’s no foolproof way to guarantee it unless they purchase the exploit — or stumble across it in the wild.

Mitigating the Zero-Day Risk

SpiderLabs offered three thoughts on reducing the risk of zero-day attacks.

First, it advised organizations to keep software up to date. LPE is one component of a successful compromise. For example, your machine may not be patched against the zero-day LPE, but it could be protected against the second portion of an attack.

Second, make sure you have a comprehensive security program that eliminates gaps. Finally, use common sense. Don’t click on unknown links or attachments, and train your employees so they do the same.

The possibility of a zero-day exploit is always there. Someone will always find a way around security. It’s up to the end user to stay safe.

More from

The importance of Infrastructure as Code (IaC) when Securing cloud environments

4 min read - According to the 2023 Thales Data Threat Report, 55% of organizations experiencing a data breach have reported “human error” as the primary cause. This is further compounded by organizations now facing attacks from increasingly sophisticated cyber criminals with a wide range of automated tools. As organizations move more of their operations to the cloud, they must also become increasingly aware of the security risks and threats that come with it. It’s not enough anymore to simply have a set of…

Data never dies: The immortal battle of data privacy

4 min read - More than two hundred years ago, Benjamin Franklin said there is nothing certain but death and taxes. If Franklin were alive today, he would add one more certainty to his list: your digital profile. Between the data compiled and stored by employers, private businesses, government agencies and social media sites, the personal information of nearly every single individual is anywhere and everywhere. When someone dies, that data becomes the responsibility of the estate; but what happens to the privacy rights…

Vulnerability resolution enhanced by integrations

2 min read - Why speed is of the essence in today's cybersecurity landscape? How are you quickly achieving vulnerability resolution? Identifying vulnerabilities should be part of the daily process within an organization. It's an important piece of maintaining an organization’s security posture. However, the complicated nature of modern technologies — and the pace of change — often make vulnerability management a challenging task. In the past, many organizations had to support manual integration work to get different security systems to ‘talk’ to each…

How I got started: SIEM engineer

3 min read - As careers in cybersecurity become increasingly more specialized, Security Information and Event Management (SIEM) engineers are playing a more prominent role. These professionals are like forensic specialists but are also on the front lines protecting sensitive information from the relentless onslaught of cyber threats. SIEM engineers meticulously monitor, analyze and manage security events and incidents within an organization. They leverage SIEM tools to aggregate and correlate data, enabling them to detect anomalies, identify potential threats and respond swiftly to security…