Zero-days that are exploited in the wild always gain a lot of attention, and rightly so. But while the malware authors usually get all the credit, the exploit writers – those who work hard to find a vulnerability and develop their top-notch exploit – often remain out of the spotlight.

In the past months, our vulnerability and malware research teams joined efforts to focus on the exploits inside malware and, specifically, on the exploit writers themselves. Starting from a single incident response case, we built a profile of one of the most active exploit developers for Windows. Up until now, we managed to track down more than 10(!) of their Windows Kernel (LPE) exploits, most of which were zero-days at the time of development.

Just as programmers leave their fingerprints in their code, so do exploit developers. This allowed us to apply the same techniques we use to track and attribute malware authors and APT groups to draw a digital composite sketch of the exploit writer.

Join us as we follow our developers’ footsteps and watch their learning curve – starting from selling their 1-day exploits to criminal groups to eventually selling 0-days to nation-state APTs. We will also explain our process of converting exploit artifacts into more samples, identifying the author’s template, and briefly go over the distribution and business model of the attacker. The talk will demonstrate how exploits can be used to track their authors and give a technical peek into the world of in-the-wild exploits.