TI-2026-061B — The Bounty and the Auction

Classification: HIGH · Dual-Use Market · Vulnerability Brokering / Intelligence-Adjacent Confidence: HIGH on the facts (payouts, founders, disclosure mechanics, CSV output — all sourced); the argument is that these facts, taken together, describe one market, not two. TLP:WHITE — external firms and public price lists named in full. Series: The Fake Umbrella — Part B. B is for Bug Bounty. The friendliest badge in security and the ugliest arms trade in security are the same economy seen from two ends. Facts are facts. They are good for some and bad for others. You decide.

The seed: a vulnerability with a price printed on it

In 061A a scanner told us its name. Here the seed is quieter and, if anything, more damning — because it is not hidden at all. Open a routine Exploit-DB advisory for a persistent cross-site-scripting bug in a small point-of-sale product and read the header:

Current Estimated Price:
========================
500€ - 1.000€

A defect in someone's shop software, described in the same breath as its market value. Not "severity: medium." Price. That single line is the whole of Part B in miniature: in this industry a vulnerability is not a problem to be fixed, it is inventory — a thing with a going rate, a buyer, and a spread. Follow that price up the ladder and it does not stop at €1,000. It runs, on a public and proudly-published schedule, all the way to two million dollars.

The comfortable story says there is a bright line between the "ethical hacker" who files a bug bounty and the "mercenary" who sells an exploit to a government. This dossier's finding is that the line is a marketing device. It is one market. The bounty is the entry tier. The auction is the apex. The pipe between them is the same research.

The friendly end: "responsible disclosure" is a gag with good manners

Start where the industry wants you to start — the reputable, wholesome side: bug bounties. HackerOne, Bugcrowd, the little "we ❤️ hackers" badges. Read the fine print of how disclosure actually works, from OWASP's own cheat sheet:

"In the private disclosure model, the vulnerability is reported privately to the organization. The organization may choose to publish the details of the vulnerabilities, but this is done at the discretion of the organization, not the researcher, meaning that many vulnerabilities may never be made public. The majority of bug bounty programs require that the researcher follows this model."

Read that again with the costume off. The finder does the work, takes the risk, and then — as a condition of payment — signs the disclosure decision over to the vendor. Whether the public ever learns their bank, their hospital, their router was vulnerable is now the vendor's call, made on the vendor's PR calendar, and "many vulnerabilities may never be made public." The bounty is not primarily a reward for defence. It is, structurally, a purchase of silence with a coupon of goodwill on top. The researcher gets a badge and a gag; the vendor gets a cheap NDA and a headline-free quarter; the users get told nothing.

That is the good end of this market. It already runs on the principle that the person who found the danger does not get to warn you about it.

The apex: the auction, with a published price list

Now the other end — the one the badges never mention. Zerodium, founded 2015 by Chaouki Bekrar, the same man behind the French exploit firm VUPEN. Headquartered in Washington, D.C. It does the opposite of disclosure: it buys working zero-day exploits from independent researchers and resells them exclusively to government and law-enforcement clients, who pay subscriptions reported at ≥ $500,000 a year for access. Its payout schedule is not a rumour — Zerodium publishes it:

Bekrar's customers, in his own description, are "mainly government organizations… as well as major corporations from defense, technology, and financial sectors." When Threatpost asked why anyone would pay half a million for a messaging-app exploit, the answer was that government customers "need advanced capabilities… to track criminals using these secure mobile apps." His predecessor firm VUPEN gave the doctrine its motto when it abandoned free disclosure: "The software companies had their chance."

Here is the mechanism the badges hide: the same skill, the same tooling, the same class of finding that earns a $1,500 bounty-under-NDA on Tuesday can earn a life-changing government payout on Wednesday. The wire cannot tell them apart. The code is identical. Only the buyer is different — and the buyer, at the top of the ladder, is a state that wants the flaw kept open.

Stockpile, don't patch: the product is your defencelessness

A defence company that fixed things would put itself out of business. So this one doesn't. The acquisition model's core, documented repeatedly, is that firms stockpile zero-days and sell them to governments rather than allowing them to be patched. The exploit's value is a direct function of how long it stays secret and unfixed. A patched bug is worth nothing; an unpatched one that Apple and a billion users know nothing about is worth two million dollars.

So the incentive is explicit and inverted: every day your device stays vulnerable is a day the inventory holds its value. "Cyber defence," "national security," "helping law enforcement track criminals" — that is the brochure. The product being sold is the continued, deliberate, monetised defencelessness of everyone who is not the customer. The insurance-company-that-employs-arsonists of 019J has a sister here: the locksmith who sells the master key and pays extra to make sure the lock is never changed.

The output: this is not abstract — it lands on real people

Where do the auction's goods end up? Google's Threat Analysis Group counted. In Buying Spying (2024): 40+ commercial surveillance vendors, and those CSVs are responsible for 50% of the known zero-day exploits used against Google products. Half. The market whose entry tier is a friendly bug-bounty badge produces, at its apex, half the zero-days fired at Chrome and Android in the wild.

And the delivery vehicles are named: NSO's Pegasus, carried on a Chrome zero-day (CVE-2023-7024) and the iOS BLASTPASS zero-click chain, used against "an individual working for a civil society organization." Variston (Spain) bought the Italian research shop Truel IT precisely for its "exclusive zero-day capabilities," and built the Heliconia spyware framework on them. The finding that starts as a line item on a price list ends as spyware on a journalist's phone. The corpus already documented the destination — this dossier documents the turnstile.

The seven questions

Who is this? A single, tiered market for vulnerabilities: bug-bounty platforms and "responsible disclosure" at the base, exploit brokers (Zerodium/VUPEN) and CSVs (Variston, NSO) at the apex.

Why did it attack? To acquire inventory. Whether the finding is "reported" or "sold," the act is the same discovery of a way in; only the destination differs.

Who does it claim to be? Ethical hackers, responsible disclosers, "cyber-defence" and "lawful-intercept" providers. The claim is that finding-and-selling flaws protects people.

Whom is it related to? The same research talent flows across the whole ladder; brokers sit adjacent to NSO/Pegasus and the CSV census of 039B; VUPEN sits in the Spy Files beside the lawful-intercept vendors of 027E.

Where is the money? Published and blunt: €500 on Exploit-DB, four-figure bounties under NDA, $500K–$2M per chain at Zerodium, ≥$500K/yr government subscriptions. The victim (the vendor's users) pays in exposure; every other tier gets paid in cash.

What is the official anchor? Registered companies with press offices and, at the top, government customers — the state is not the regulator here, it is the paying client. That is the anchor and the problem in one.

What if it is not who it claims? It is exactly who it claims — an "ethical," "lawful," "defensive" market. The finding is that the market so described is, by its own published mechanics, an arms trade in the public's defencelessness.

What if…

• What if bounties genuinely get bugs fixed? Some do — and the private-disclosure model still means you, the user, are told at the vendor's discretion, often never. "Fixed quietly" is better than "sold." It is not the same as "you were warned." The gag is real even when the patch is real.
• What if brokers only sell to democracies? Unfalsifiable by design (customers are secret) and refuted by the record: the same class of goods appears in Pegasus deployments against civil society. A market that cannot show its customers is not entitled to the presumption that they are benign.
• What if regulating this just pushes it underground? It is already above ground — with a published price list. The apex of this trade advertises. "Driving it underground" describes a market that is currently, openly, legally selling two-million-dollar keys to your phone in daylight.

Steelman: the strongest defence — and why it fails

The industry's best case, built at full strength:

"Bug bounties measurably reduce risk: they pay researchers who would otherwise go unrewarded, and get thousands of real bugs fixed. Exploit brokers like Zerodium serve lawful government customers who need capabilities to fight terrorism and serious crime, under legal authority. Researchers deserve to be paid for their work. Vilifying a regulated, taxpaying industry punishes the people making software safer."

Where it breaks:

• "Gets bugs fixed" concedes the gag. The strongest pro-bounty claim still runs entirely on the private-disclosure model — the one that, by OWASP's own words, leaves disclosure to the vendor and many bugs never public. It defends the outcome (a patch) by defending the mechanism (your silence). That is the indictment, not the rebuttal.
• "Lawful government customers" is the trapdoor, not the floor. 027E mapped exactly this: the state–vendor boundary is kept ambiguous so that "lawful" can cover anything a client does. The customers are secret; the goods turn up in Pegasus. "Lawful" here means "we don't ask, and you can't check."
• "Researchers deserve to be paid" is true and misused. Yes — which is an argument for fixing and funding disclosure, not for a market whose top tier pays the most precisely when the flaw is kept unpatched. The steelman smuggles a fair premise (pay researchers) to defend an unfair structure (reward secrecy and non-repair).
• The one true thing: not everyone in this market is a mercenary, and a genuine, patched, promptly-disclosed bounty is a real public good. That earns the base tier a fair hearing. It does not launder the apex, and it does not dissolve the pipe that connects them.

Verdict: the individual honest bug-bounty hunter is not the target and not the finding. The market structure is — a continuous economy that prices human defencelessness, gags the people who could warn you, and at its published apex sells the results to states for millions. Confidence: HIGH on every fact; the "we make software safer" defence is rejected on the market's own price list.

Read between the lines

The tell is that the apex publishes its prices. A criminal fence hides. Zerodium advertises — a rate card for zero-days, like a menu. That confidence says the quiet part: this trade has already been normalised into "the industry," with conferences, LinkedIn titles, and government contracts, so that selling a $2M key to a billion people's phones reads as a career, not a crime. The price list is not recklessness. It is a firm that knows no one who matters will call it what it is.

And read the direction of silence. At the friendly end, the NDA points down — it silences the researcher toward the public. At the apex, the secrecy points up — it hides the customer from everyone. Both ends of the market are built to make sure the person exposed is the last to know. That is not a bug in the model. It is the model.

The human layer

Picture the researcher: talented, underpaid, twenty-six, staring at a working exploit and two offers. One is a bounty — a badge, a few thousand, and a contract that says never tell anyone. The other is a broker — six or seven figures, wired quietly, and a contract that says the same thing. Both told her to keep the danger secret. Only one made her rich. The market did not corrupt her; it simply priced her honesty and then priced her silence higher. Meanwhile the person whose phone holds the flaw — a reporter, an organiser, someone's mother — never enters the transaction at all, except as the asset being traded. They are not the customer and not the researcher. They are the thing on the shelf. They find out, if they ever do, when the spyware is already inside.

Defense — price the market honestly, and refuse the gag

(1) Read a bounty program's disclosure terms before you trust its badge. "We work with researchers" often means "we control whether you're ever told." Prefer vendors that commit to coordinated public disclosure with deadlines, not vendor-discretion silence. (2) Treat "lawful-intercept" / "cyber-defence" vendor language as 027E-class marketing, not assurance — the customers are secret and the goods appear in Pegasus. (3) Patch on the assumption the flaw is already inventory. If a bug in your stack exists, assume someone may be holding it unpatched because it's unpatched; speed of patching is the only thing that devalues their stock. (4) Support the reform, not the outrage: funded, deadline-bound, publicly-disclosed vulnerability handling is the actual antidote — it pays researchers and warns users, which is the exact combination the current market is built to prevent.

Investigation metadata

Next — TI-2026-061C: C is for Cellebrite — the phone-cracking "digital forensics" vendors that sell "help for law enforcement," and where those help-desks turned up: on the phones of dissidents, in the hands of regimes, with the receipts.

A bug bounty and a zero-day auction ask the researcher the same question — "will you keep this secret?" — and the only difference is the size of the cheque. One market, two counters. At one, they hand you a badge; at the other, a wire transfer. Both hand the person in danger nothing but the danger. Facts are facts. They are good for some and bad for others. You decide.