Some zero-day vulnerabilities are exploited actively. How does this happen? How often does this happen? How do so many hackers get to know about the same vulnerability?
People look for new, undisclosed vulnerabilities. That's how they become zero-days. Then, once they find them, they exploit them. Then, they often share what they found with their friends, or sell the info on the black market.
This is all available for you to know if you perform a little research, like on wiki: https://en.wikipedia.org/wiki/Zero-day_(computing)
Day 0 can be very, very long
When you're talking about zero-day vulnerabilities, the days start counting from public disclosure of the vulnerability. Assuming that a "black hat" discovers the vulnerability, it can be used on many targets (possibly for multiple years) before it's disclosed.
Furthermore, if a vulnerability is discovered "in the wild", then it's quite likely that an exploit is available to the public on the same day, but a fix or workaround is not yet developed. People with a motivation to attack particular targets are constantly monitoring this information, and would reasonably apply a useful vulnerability on the same day as it's available, since the actual exploit is just a small part of an attack or botnet and they can have the rest of the infrastructure and target information prepared and waiting for the time when a new vulnerability inevitably appears.