The Zero-Day Broker Market: How Governments Buy the Exploits That Spy on You

#The legitimate market that arms surveillance

Here's the part consultants don't put in the glossy PDF.

The zero-day vulnerability brokerage market is real, legal, and surprisingly open about itself. Companies like Zerodium, Crowdfense, Operation Zero. And dozens of smaller brokers publish price lists showing what they'll pay researchers for working exploits. Their customers. Governments and government-adjacent entities. Use those exploits to conduct signals intelligence, criminal investigations, and (in documented cases) human rights abuses.

As of April 2026, Zerodium's publicly listed top payout is $2.5 million for a full iOS zero-click exploit chain. Crowdfense has paid up to $15 million for similar-caliber exploits to preferred researchers. Operation Zero, the Russian broker, offered $20 million for Android and iOS zero-click chains in 2024. The highest public bounty ever.

These aren't theoretical capabilities. The chains being purchased get deployed. In 2021-2025, the NSO Group's Pegasus spyware. Built on zero-days acquired from this market. Was documented targeting journalists at the Washington Post, activists in Saudi Arabia, attorneys representing Jamal Khashoggi's family. And allegedly the phones of members of the US State Department.

This post walks through how the zero-day market works, who's buying, who's selling, what it costs. And what the existence of this market means for your own threat model.

#What a zero-day is

A "zero-day" vulnerability is a flaw in software that the vendor doesn't know about. No patch exists. No CVE has been issued. The defender has zero days to prepare before someone can exploit it.

Variants matter:

• N-day. A vulnerability that HAS been patched but for which not everyone has applied the patch yet. Still exploitable against unpatched systems. Less valuable than true zero-days.
• One-day. A vulnerability disclosed / patched within 24-48 hours. Briefly exploitable against the delta between disclosure and mass patching.
• Full exploit chain. A sequence of vulnerabilities chained together to achieve a specific capability (e.g., "visiting a malicious URL silently roots your iPhone"). The chains are worth more than individual vulnerabilities.
• Zero-click. An exploit that requires no user interaction. Often worth 10-100x more than exploits requiring a click or tap.

#Who's buying

The buyers fall into a few categories.

#Sovereign governments with sophisticated cyber programs

United States: the NSA, CIA, FBI, and military cyber commands acquire exploits through multiple channels. Some directly contracted, some via intermediary contractors. US exploit acquisition is legally sanctioned under various authorities.

Five Eyes partners: UK, Canada, Australia, New Zealand. Similar acquisition infrastructure, often sharing via intelligence-liaison channels.

Israel: offensive cyber capability heavily developed. Unit 8200 alumni founded multiple commercial exploit brokers and spyware companies. Ongoing government market.

Russia: Operation Zero (2023-present) is the visible brokerage. FSB, GRU, SVR all have internal capabilities plus external acquisition.

China: extensive internal capability (MSS, PLA). Also buys from external brokers when internal can't deliver. Tianfu Cup internal competition has been documented as an exploit-harvesting mechanism. Contest exploits become state exploits.

Iran, North Korea, Saudi Arabia, UAE, Turkey, Egypt, Mexico, India: documented zero-day acquisition programs at various scales.

#Commercial spyware vendors

The NSO Group (Pegasus), Candiru, Cytrox (Predator), Intellexa (the umbrella company for several of these), Paragon (Graphite), QuaDream, RCS Lab, DarkMatter, NOVALPINA. And others. These companies acquire zero-days from brokers, package them into turnkey spyware products, and sell to governments.

NSO has explicitly stated publicly that it sells only to "vetted" government customers. Multiple investigations have documented deployments against journalists, activists. And civilians that seemed to violate those claims.

#Contractors and integrators

Defense contractors like L3Harris Trenchant (acquired Azimuth Security), KeyW. And others acquire exploits on behalf of government clients and incorporate them into broader capability packages.

#Bug bounty programs (the legitimate alternative)

Apple, Google, Microsoft, Meta, Samsung, and others operate bug bounty programs that pay researchers for vulnerabilities. The payouts are increasing. Apple's top payout for a full-chain kernel-level iOS exploit reached $2 million in 2024. But are consistently below the gray-market broker prices. Vendors are structurally unable to outbid governments.

#The major brokers

#Zerodium

Founded 2015 by Chaouki Bekrar (previously of VUPEN). Based in Washington, DC. US clients primarily. Publicly states it sells to "government organizations from Western democracies."

Published price list (current, as of 2026):

• iOS Full Chain Zero-Click (no user interaction) with persistence: up to $2.5 million
• Android Full Chain Zero-Click with persistence: up to $2.5 million
• WhatsApp Remote Code Execution (RCE) with no user interaction: up to $1.5 million
• iMessage RCE with no user interaction: up to $1.5 million
• iOS Full Chain with one click: up to $1 million
• Chrome Remote Code Execution with sandbox escape: up to $500,000
• Firefox Remote Code Execution with sandbox escape: up to $150,000
• Microsoft Edge Remote Code Execution with sandbox escape: up to $150,000
• Safari Remote Code Execution with sandbox escape: up to $400,000
• Windows Local Privilege Escalation: up to $80,000
• Linux Local Privilege Escalation: up to $100,000
• macOS Local Privilege Escalation: up to $100,000

Zerodium updates prices periodically based on supply. As more researchers produce iOS exploits, prices tend to drop. As Apple patches rapidly, prices rise.

#Crowdfense

UAE-based. Emerged in 2017. Higher payouts than Zerodium for comparable exploits.

Published program offers (recent):

• Mobile Full-Chain (iOS or Android): up to $7 million (2023-2024 premium program)
• More recent offers up to $9 million for preferred researchers
• WhatsApp Remote Code Execution: up to $3-5 million
• Chrome sandbox escape: up to $1.2 million

Crowdfense explicitly seeks to outbid Zerodium and has paid researchers premium prices for high-value capabilities.

#Operation Zero

Russian broker founded 2023. Caused significant industry disruption with aggressive pricing.

Published offers:

• Android or iOS Zero-Click Full Chain: up to $20 million (2024 offer)
• Mobile Apps remote code execution: varies by app

Operation Zero's customer base is assumed to be primarily Russian government, though detailed customer information isn't public. The $20M offer set a new market ceiling.

#Smaller brokers

• Exodus Intelligence (US): intelligence feeds and exploits
• Azimuth / L3Harris Trenchant (Australia / US): deep government contracts
• Netragard (US): bought back into the market periodically
• Ability Inc / Ability Unlimited (Israel): defunct, revived
• Various Chinese brokers operating with less public visibility

#How researchers interact with the market

From a researcher's perspective, the decision tree is:

Option A: Bug bounty programs (vendors directly)

• Legitimate, widely accepted
• Lower payouts than gray market
• Fast turnaround
• Researcher identity can be public
• Researcher name on Hall of Fame
• Payments are taxable as ordinary income, typically via 1099

Option B: Independent research + public disclosure

• Zero direct compensation
• Researcher reputation-building
• Risk of vendor legal action if done poorly
• Requires careful coordinated disclosure
• Traditional "responsible disclosure" path

Option C: Broker gray market (Zerodium, Crowdfense, Operation Zero)

• Much higher payouts
• Legal in most jurisdictions (vulnerability sale to governments is typically legal)
• Researcher identity confidential
• Contractual restriction against disclosure
• Exploit may be used against journalists, activists, civilians
• Reputation questions within the security community

Option D: Government contractor direct

• Highest-trust arrangements
• Long-term compensation
• Requires security clearance
• Limited to specific nationalities
• Exclusive arrangements with specific governments

The competition between options creates an arms race. Vendors' bug bounties are getting more competitive. Gray market prices are rising. Researchers increasingly stratify:

• Junior researchers: bug bounty programs
• Mid-career researchers: mix of bug bounty and gray market
• Top-tier researchers: primarily gray market or direct contractor work

#The ethics debate

The zero-day market is openly discussed in the security community, and the ethics are contested.

#The "we sell to democracies only" argument

Zerodium and Crowdfense both claim to vet customers. Stated policy: sell only to democratic governments for lawful intelligence and law enforcement purposes. Both companies have published policies excluding certain buyer categories.

Critics note:

• "Vetted customer" ≠ "won't misuse." Saudi Arabia has been documented misusing spyware. It's a Western ally.
• Once an exploit is sold, the broker has no control over subsequent use.
• The vetting process is opaque and unverifiable externally.
• Multiple documented cases of spyware built on gray-market exploits being used against journalists, activists, and attorneys.

#The "someone will pay anyway" argument

Some researchers argue that if they don't sell their exploit, someone else will. The exploit exists regardless. Not selling forgoes compensation without changing the outcome.

Critics note:

• Supply doesn't perfectly elasticize. Each exploit not sold is, on net, slightly more difficult to replace.
• Some researchers refusing the gray market is part of what keeps vendor bug bounty programs' prices rising.
• The pool of capable researchers is small. Individual choices matter in aggregate.

#The "researchers deserve fair compensation" argument

Finding a full-chain iOS exploit is an extraordinary technical achievement. It takes months of work. Vendor bug bounties pay less than a senior engineer's monthly salary for months of work. Gray market pays the fair value.

Critics note:

• Fair-market compensation doesn't resolve the ethics of downstream use.
• The choice to work in this space is itself ethical. Researchers can choose other specializations.

#The "government surveillance is necessary" argument

Some researchers argue that effective intelligence and law enforcement capability is necessary for legitimate state functions. And purchased exploits are part of that capability.

Critics note:

• "Necessary for legitimate state functions" doesn't justify commercial trafficking in vulnerabilities that will leak, be discovered independently, or be deployed against illegitimate targets.
• The same exploit sold to a "legitimate" state can be exfiltrated by insiders or compromised and end up in criminal hands. This has happened (Shadow Brokers leak of NSA exploits, various spyware source code leaks).

#What this means for defenders

For organizations and individuals defending against sophisticated adversaries, the zero-day market shapes the threat model:

#Zero-click exploits exist and are deployed

Against high-value targets (executives, politicians, journalists, attorneys, activists), zero-click exploits delivered via WhatsApp, iMessage, email, or other apps are a real threat. The primary defenses:

• Apple Lockdown Mode. For iPhone users, Lockdown Mode substantially reduces zero-click attack surface. Disables various features that have been common zero-click vectors. Recommended for high-risk users.
• GrapheneOS. Android users with threat model including nation-state capability should use GrapheneOS, which has documented resistance to common exploit chains.
• Behavioral opsec. Reduce exposure. Separate devices for high-sensitivity communications. Don't use a single device for everything.
• Regular reboots. Some implants don't persist across reboot. Regular reboots reduce implant dwell time.

#Nation-state threat modeling

If you're in a category targeted by nation-state attackers. Journalists, activists, dissidents, executives at strategically important companies, government employees with clearances. The zero-day market's existence is part of your threat model. You can't defend perfectly against an adversary with $10M exploit budgets. But you can:

• Minimize attack surface (fewer apps, fewer accounts, fewer communication channels)
• Compartmentalize (separate devices for separate functions)
• Monitor for unusual device behavior (unexplained battery drain, unexplained network activity)
• Use privacy-focused tools (Signal over iMessage for sensitive conversations, etc.)
• Accept that perfect security is impossible. Aim for making yourself harder-than-average targets

#Corporate threat modeling

For most corporations, the gray zero-day market isn't directly relevant to your threat model. Criminals buying gray-market exploits don't typically target generic enterprises. The cost-benefit doesn't work. Exceptions:

• Defense contractors: nation-state targeting is a real threat vector.
• Large cryptocurrency operations: North Korean groups have used purchased exploits against crypto targets.
• Organizations with geopolitically sensitive data: energy, telecommunications, media companies targeted by state actors.

For these organizations, the threat model includes adversaries who have purchased exploits and can deploy them. Defense requires layered detection, aggressive patching. And recognition that a well-funded adversary can succeed against any specific asset.

#The attribution and response challenge

When an organization is targeted with a zero-day exploit, attribution is hard. The exploit itself doesn't carry a "made by" tag. The deployment infrastructure may be routed through multiple cutouts. The same exploit chain can be used by many different actors who acquired it independently.

This makes incident response difficult. You may know you were targeted with a zero-click exploit but not know who specifically targeted you or why.

Forensic services like Access Now, Amnesty International's Security Lab, Citizen Lab (University of Toronto). And commercial firms like Kaspersky's GReAT team specialize in mobile exploit forensics. If you suspect you're being targeted with spyware, these are the organizations to consult.

#The policy landscape

Zero-day regulation is minimal. Existing frameworks:

Wassenaar Arrangement: a multilateral export control regime covering dual-use technologies including some cyber capabilities. In 2013, cyber surveillance tools were added to the control list. Implementation has been uneven. The US hasn't fully implemented the cyber provisions.

Vulnerabilities Equities Process (VEP): the US government's framework for deciding whether discovered vulnerabilities get disclosed to vendors or retained for intelligence use. Notable for being less transparent than advocates would prefer.

Proposed "pall of silence" rules: various proposals to restrict or regulate the sale of exploits have been introduced in multiple jurisdictions. None have become law.

Commercial spyware sanctions: the US Treasury has sanctioned specific spyware companies (NSO Group, Candiru, Intellexa) under various authorities. More likely to continue than policy reform of the broader market.

The reality: the zero-day broker market is largely unregulated. Sovereign customers can buy. Commercial vendors can sell. The only meaningful restraint is specific sanctions against specific companies.

#What happens when purchased exploits leak

A recurring pattern: government-purchased exploits leak back into the criminal ecosystem.

• EternalBlue (NSA Equation Group exploit, leaked by Shadow Brokers in 2017): became the basis of WannaCry, NotPetya, and countless subsequent ransomware attacks. Tens of billions in damages.
• Pegasus source code (partially leaked over the years): has informed development of commodity spyware.
• Various Candiru / Intellexa exploits: end up in analysis tools and eventually criminal kits.

The supply chain from "purchased to spy on journalists" to "deployed as commodity ransomware" is short. The idea that purchased exploits stay contained to their intended purpose is historically unsupportable.

#What Valtik does in this space

Valtik's threat intelligence engagements include zero-day-era threat modeling for organizations with nation-state adversary concerns:

• Adversary capability assessment. What exploit categories are likely in adversary hands for your threat model?
• Attack surface minimization. Practical reductions in exploitable surface.
• Lockdown Mode / GrapheneOS deployment. For high-risk individuals in your organization.
• Detection engineering. What anomalies suggest zero-click deployment?
• Incident response coordination. With Citizen Lab, Amnesty Security Lab, or commercial forensics as appropriate.

For organizations that are genuinely targeted by nation-state actors. Defense, critical infrastructure, media, NGOs. These engagements provide the honest threat-modeling that other providers may lack the appetite for. Reach out via https://valtikstudios.com.

#The honest summary

The zero-day broker market is a functioning, profitable, largely legal industry that sells offensive cyber capabilities to governments. The market's product gets used against journalists, activists, executives, and unknown targets. The defenses against market-purchased exploits are real but limited.

If you're concerned about being targeted specifically, you're likely in a small minority of individuals and organizations for whom nation-state threat modeling is appropriate. If you're not. 99%+ of readers. The market affects you indirectly: shaping the vulnerability economy, draining research talent from defensive work. And occasionally leaking exploits that end up in criminal hands.

The rational defensive posture: keep your software patched, use privacy-focused tools, reduce attack surface. And recognize that perfect security against this adversary class isn't achievable.

#Sources

1. Zerodium Official Program
2. Crowdfense Exploit Acquisition Program
3. Operation Zero Program
4. Apple Security Research Bounty
5. Citizen Lab Pegasus Research
6. Amnesty International Security Lab
7. Access Now Digital Security Helpline
8. Vulnerabilities Equities Process. US Government
9. Wassenaar Arrangement
10. US Treasury Spyware Sanctions. NSO Group Commerce Listing