A Cybersecurity Startup’s Zero-Day Market Is Built on Fraud and Felonies A startup offering millions in rewards for zero-day vulnerabilities in widely used

A Cybersecurity Startup’s Zero-day Market Is Built on Fraud and Felonies

A startup offering millions in rewards for zero-day vulnerabilities in widely used software is being run by two convicted felons with a history of operating fake intelligence firms and a defunct AI lobbying platform. The company, which markets itself as a leader in offensive cybersecurity, has no verifiable track record of ethical vulnerability disclosure or responsible disclosure practices. Instead, its founders have ties to far-right conspiracy networks and a pattern of financial fraud, raising serious questions about the legitimacy of its zero-day acquisition program and the risks it poses to software security.

What Changed and Why It Matters

The startup in question,dubbed "VulnHaven" in Krebs on Security’s reporting,positions itself as a buyer of zero-day vulnerabilities, offering substantial financial incentives to researchers who uncover flaws in popular software. The business model mirrors that of other offensive cybersecurity firms, such as those that sell exploits to nation-states or private equity firms. However, the founders’ criminal records and past ventures in disinformation and fraud distinguish VulnHaven from legitimate players in the vulnerability market.

Key details from the report:

• The company’s founders have prior convictions for fraud and conspiracy.
• Their previous ventures included a fake intelligence firm and an AI-powered lobbying platform that collapsed under scrutiny.
• VulnHaven’s zero-day acquisition program lacks transparency about how vulnerabilities are handled after purchase.
• The startup’s marketing materials do not disclose its founders’ criminal histories or their ties to far-right conspiracy networks.

This matters because the zero-day market is already a high-risk ecosystem. Vulnerabilities acquired by unscrupulous actors can be weaponized before vendors have a chance to patch them, leading to widespread exploitation. If VulnHaven’s program operates without ethical safeguards,or worse, if it is a front for malicious actors,the consequences could include prolonged exposure of unpatched flaws in critical software.

Who Is Behind Vulnhaven?

The two founders of VulnHaven have a documented history of fraudulent activity. According to Krebs on Security, one was convicted in 2022 for operating a fake intelligence consulting firm that billed government agencies for nonexistent services. The other was involved in a separate fraud scheme tied to an AI lobbying platform that promised to influence policymakers using automated advocacy tools but failed to deliver results.

Their past ventures suggest a pattern of exploiting trust to extract financial gains, rather than building a legitimate cybersecurity business. VulnHaven’s zero-day acquisition program, which offers millions for vulnerabilities, could be a vehicle for funneling exploits to malicious actors,including state-sponsored hackers or cybercriminal syndicates,rather than ensuring responsible disclosure.

How the Zero-day Market Works (and Why This Is Risky)

The zero-day market operates on a simple premise: buyers pay top dollar for undiscovered vulnerabilities in widely used software, often before vendors are aware of the flaws. Legitimate players in this space,such as bug bounty programs run by companies like Google or Microsoft,follow responsible disclosure guidelines, ensuring that vulnerabilities are patched before details are made public.

However, the market is also rife with unethical actors. Some buyers resell exploits to governments or cybercriminals, while others hoard vulnerabilities for ransomware attacks or espionage. VulnHaven’s lack of transparency about its acquisition process and its founders’ criminal records raise concerns that it may operate outside these ethical boundaries.

Key risks of an unregulated zero-day market:

• Prolonged exposure: If vulnerabilities are sold to malicious actors before patches are available, software users remain at risk for extended periods.
• Weaponization: Exploits acquired by state-sponsored groups or cybercriminals can be used in large-scale attacks, such as ransomware campaigns or state-backed espionage.
• Reputation damage: If VulnHaven’s program is exposed as a front for fraud, it could undermine trust in the broader vulnerability disclosure ecosystem.

What Is Confirmed Vs. Unconfirmed

The Krebs on Security report provides clear evidence of the founders’ criminal histories and their past fraudulent ventures. However, several aspects of VulnHaven’s operations remain unconfirmed:

• Vulnerability handling: The report does not detail how VulnHaven processes or discloses vulnerabilities after acquisition. Without transparency, it is impossible to verify whether the company follows responsible disclosure practices.
• Current operations: While the report describes VulnHaven’s zero-day acquisition program, it does not confirm whether the company is actively acquiring vulnerabilities or if the program is still operational.
• Connections to malicious actors: The report suggests ties to far-right conspiracy networks, but it does not provide direct evidence of collaboration with cybercriminals or state-sponsored groups.

What to Watch Next

1. Regulatory action: Authorities may investigate VulnHaven’s operations, particularly if its zero-day acquisition program is found to violate cybersecurity laws.
2. Exploitation events: If vulnerabilities acquired by VulnHaven are used in attacks, details may surface in threat intelligence reports.
3. Industry reactions: Legitimate cybersecurity firms may issue statements distancing themselves from VulnHaven or calling for greater transparency in the market.
4. Legal challenges: Given the founders’ criminal records, there is a possibility of further legal action if VulnHaven’s operations are deemed fraudulent.

For now, the tech community should treat VulnHaven’s zero-day acquisition program with caution. Until its practices are fully documented,and its founders’ intentions are clarified,the risks of engaging with the company may outweigh the potential benefits.

Why This Should Concern the Tech Community

The zero-day market is a double-edged sword. On one hand, it incentivizes security research by offering financial rewards for discovering critical flaws. On the other hand, it creates opportunities for malicious actors to exploit software before patches are available. VulnHaven’s emergence,backed by convicted felons with a history of fraud,highlights the need for stricter oversight in this space.

For organizations that rely on third-party vulnerability disclosure programs, the risks include:

• Supply chain attacks: If VulnHaven acquires vulnerabilities in widely used libraries or frameworks, those flaws could be weaponized against downstream users.
• Reputation harm: Associations with unethical vulnerability brokers could damage an organization’s trustworthiness, particularly if vulnerabilities are exploited in attacks.
• Legal exposure: If VulnHaven’s operations are found to violate responsible disclosure guidelines, organizations that work with it may face liability concerns.

What Developers and Security Teams Should Do Now

What Developers and Security Teams Should Do Now

While there are no immediate mitigation steps for vulnerabilities acquired by VulnHaven,since the company’s operations are not yet fully documented,security teams should:

• Monitor for exploitation: Keep an eye on threat intelligence feeds for signs that vulnerabilities tied to VulnHaven are being exploited in attacks.
• Advocate for transparency: Push for greater accountability in the zero-day market, including public disclosures of acquisition practices and responsible disclosure commitments.
• Diversify disclosure channels: Rely on multiple vulnerability disclosure programs,including those with verified ethical track records,to reduce dependence on any single broker.

The Broader Implications for Cybersecurity Ethics

VulnHaven’s case raises broader questions about the ethics of the zero-day market. While financial incentives can drive security research, they also create opportunities for abuse. The lack of regulation in this space means that unscrupulous actors can operate with impunity, putting software users at risk.

For the tech community, this underscores the need for:

• Stronger ethical guidelines: Clear standards for vulnerability acquisition, disclosure, and handling should be enforced by industry groups.
• Transparency in acquisition: Buyers of zero-days should be required to disclose their practices and ensure responsible handling of vulnerabilities.
• Legal consequences for fraud: Convicted felons with histories of financial fraud should not be allowed to operate in high-risk areas like cybersecurity without oversight.

Sources

• krebsonsecurity.com. https://krebsonsecurity.com/2026/07/felons-fraudsters-flog-offensive-cybersecurity-startup/