Zerodium, one of the biggest buyers of zero-day vulnerabilities known as zero-day (previously undiscovered, undetected), aims to expand its portfolio a bit further.
With the tweet posted by Zerodium on October 19th ExpressVPN, NordVPN and Surfshark has been announced to purchase information disclosure, ip address disclosure or remote code execution vulnerabilities. It was also specifically stated that local privilege escalation vulnerabilities were not dealt with.
These three VPN companies are known to serve at least 17 million users and have around 11,000 servers worldwide.
Zerodium, on the other hand, is a company that provides exploits and vulnerabilities for “fighting terrorism, fighting crime” to government. In other words, the vulnerabilities that security researchers have sold to them are generally made available to North American and European states and to the use of these statedollar cool intelligence organizations.
Most likely, the reason for purchasing security vulnerabilities from these VPN services is that any government is after someone who uses these VPN services. Zerodium, which has been subject to criticism many times due to this business model, says that it conducts its series completely in accordance with ethical principles and chooses its customers by adhering to strict criteria.
We know that ExpressVPN and NordVPN are often used for concealment, especially by all kinds of cybercriminals. Surfshark has had its fair share of this lately. Especially the NSA recently carried out brute-force attacks on various Kubernetes structures by hiding behind these services by Russian hackers. had said.