What does Zerodium do with their bought exploits and bugs? [closed]

Question

I came across the cybersecurity company Zerodium. They offer bigger bounties than most of the companies calling for bug hunters:

Because of the bigger bug bounties, bug hunters sell their found exploits/bugs to Zerodium rather than to the company having the exploits/bugs.

On their "About us" page they don't mention what they do with their bought exploits and bugs or how they earn their money. In their faq they mention:

ZERODIUM customers are mainly government organizations in need of specific and tailored cybersecurity capabilities, as well as major corporations from defense, technology, and financial sectors, in need of protective solutions to defend against zero-day attacks. Access to ZERODIUM solutions and capabilities is highly restricted and is only available to a very limited number of organizations.

Is there any further information to their customers and what Zerodium does with their purchased exploits and bugs?

Answer 1

Zerodium is not "well-known for their big bounties", but they are well-known for aggressive marketing. They are actually fairly small players in the whole exploit broker market, and they pay up far less than they advertise. In general, companies like these will buy weaponized exploits and resell them, usually to governments which use them to, among other things, exploit and track dissidents or even journalists.

Note that the price they list is the maximum payout. The vast majority of exploits will be bought for a far lower price. It is more likely to align with the price they sell it for, as they need to make a profit as ethically-challenged opportunists. As governments have ample money from tax payers, they can afford to pay non-competitive prices and ensure that Zerodium and their ilk sell preferentially to them.

The 0day industry is composed of a number of different companies, some of which are explicitly government contractors, as well as private individuals who buy and sell exploits. Generally, you give them a weaponized exploit and they pay you slowly over a period of time. If for whatever reason the exploit is patched before they have finished paying out, they will stop paying you. This provides an incentive not to use up and burn the exploit on your own. Exploit brokers often know each other and word about which vulnerabilities are in possession travel fast, which itself makes it difficult to try to sell the same vulnerability to multiple different companies. This is true of most exploit brokers.

Answer 2

From Wikipedia, second sentence:

Its main business is acquiring premium zero-day vulnerabilities with functional exploits from security researchers and companies, and reporting the research, along with protective measures and security recommendations, to its corporate and government clients.

And from the second reference in the Wikipedia article: Here's a spy firms price list for secret hacker techniques:

... customers, which it says include "government organizations in need of specific and tailored cybersecurity capabilities," as well as corporate customers it says use the techniques for defensive purposes

It is not publicly documented what the customers actually do with this bought knowledge and who the customers are exactly (i.e. legal and ethical aspects are not known and might actually not align with the ethics most of us have) - but it seems to be worth for them to buy these information.