Zero-Day Bounties & Convicted Criminals: The Trust Crisis in OffSec Brokers

Saw the latest KrebsOnSecurity report regarding the offensive security startup allegedly run by convicted felons. It really highlights the unregulated, 'Wild West' nature of the gray market for zero-days. We're seeing bad actors not just developing exploits, but acting as the middlemen for RCEs in critical software like VPNs and remote access tools.

From a defensive perspective, this is terrifying because these actors have zero incentive to follow responsible disclosure. If a zero-day for a popular VPN leaks from this outfit, we're flying blind until a patch drops. We often rely on waiting for CVEs to update our SIEM rules, but in this scenario, we need behavioral analysis.

To catch these 0-days in the wild before signatures exist, we often look for process hollowing or suspicious injection attempts in office suites. Here is a basic KQL query I use to hunt for anomalous parent-child processes that might indicate an exploit chain in progress:

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in ("explorer.exe", "winword.exe", "excel.exe")
| where FileName in ("powershell.exe", "cmd.exe", "wmiprvse.exe")
| where ProcessCommandLine !contains "Microsoft" and ProcessCommandLine !contains "Windows"
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine


It’s not perfect, but with these unregulated brokers, heuristics are all we have. How is your org handling the risk of zero-days being traded by unvetted entities? Are we seeing more pushback from legal/compliance on using tools from these vendors?