Exploit Brokers and Offensive Cyber

A necessary step in conducting offensive cyber operations is developing or acquiring an exploit. While these can be developed within government agencies, they can also be procured from private actors. Studying such markets represents an opportunity to understand offensive cyber operations, especially as markets break from the secretive culture of intelligence agencies. This paper provides novel evidence by collecting longitudinal data of the prices quoted by an exploit broker who claims to sell to governments. We show the existence of exploit price inflation of 44% per annum. We find higher prices for exploits targeting devices used by individuals (e.g. Apple iOS) relative to firms (e.g. desktop Windows OS). Exploits requiring additional capabilities like physical access to the device are sold at a discount, and no-click remote access vulnerabilities carry a heavy premium. The broker does not quote prices for any exploits that specifically target industrial control systems or IoT devices. We conclude by discussing how these results inform the future of offensive cyber.