zeroplayer

zeroplayer is a threat actor and exploit supplier associated with the advertising and sale of high-end, expensive software vulnerabilities. The actor has been linked to the commoditization of advanced exploit capabilities by offering multiple zero-day and exploit-class capabilities to prospective buyers, including a WinRAR exploit, a Windows local privilege escalation exploit, an exploit described as capable of disabling antivirus and EDR protections, a remote code execution zero-day affecting a popular corporate VPN product, and a claimed Microsoft Office sandbox escape remote code execution zero-day. zeroplayer appears to function primarily as an upstream broker or vendor of offensive capability rather than as a publicly documented intrusion set conducting its own named campaigns. The actor’s role is notable because commercialized exploit access can accelerate adoption of vulnerabilities across both espionage and financially motivated ecosystems. Available reporting supports characterization of zeroplayer as specializing in exploit sales and defense-evasion-enabling capabilities, but does not provide high-confidence attribution to a specific country, victim geography, or industry targeting profile.