In other cases, criminals might uncover such vulnerabilities through their own digging. Or they could buy them from independent researchers that find them and sell them to the highest bidder. Those researchers often sell such bugs to the company whose product is vulnerable or to intelligence agencies that want to use them for spying. But they've been known to sell them to criminal groups as well.

Source: Washington Post July 08, 2021 11:37 UTC