Bdtyktl

I am trying to understand why an attacker would want to wait to use a zero-day exploit.

I have read that an attacker does not want to waste the zero-day because they are typically very expensive to obtain in the first place, but it is not clear to me what is meant by “waste” here. Zero-days can be discovered by the community (e.g. security researchers) which would render it useless. In this sense, the zero-day has been wasted by the inaction of the attacker. Is there a risk with using the zero-day exploit too soon? It seems that an attacker would want to minimize the chances of the zero-day being discovered, and thus use it as quickly as possible.

Question: What factors would cause the attacker to wait to use a zero-day exploit?

Because the old ways are the best.
Why blow an expensive 0-day when you can just use a sweet SMBv1 attack or SQLi that will give you the same result?
Using an 0-day can result in discovery from a forensics response reducing value and eliminating the number of targets it will be effective against.

It's more likely that you'll burn a 0day by using it than by sitting on it.

There's a fine balance between sitting on a 0day so long that it gets discovered by someone else and patched, and using it too early and unnecessarily, burning it. The balance tends to weigh in favor of waiting longer, since a good 0day is going to be obscure enough that it won't be quickly found. The biggest risk actually isn't discovery in that case, but obsolescence when the vulnerable code is re-written or removed for completely unrelated reasons, and the 0day exploit no longer works.

Most of the time, however, an attacker simply doesn't need to use it. If I have a valuable Linux local privilege escalation exploit, why would I use it when a little bit of extra reconnaissance tells me I can use an old exploit against an improperly patched privileged daemon? Better to keep it in the rainy day fund.

There are a few other reasons 0days may be kept for long periods:

1. Some people simply hoard 0days for the sake of it. This is all too common.




2. Maybe you borrowed the 0day from someone, in which case burning it would piss them off.




3. Sometimes a 0day broker is sitting on them while waiting for the right client.