There are a few manner ins which crooks can acquire zero-day malware:
1. They can buy it on the black market.
2. They can develop it themselves.
3. They can take it from a genuine business or person.
4. They can find it in the wild.
https://westpennjournal.com/?p=941 The most common way that bad guys obtain zero-day malware is by buying it on the black market. There are a number of black markets that sell zero-day malware, and the prices can differ depending on the demand and the elegance of the malware.
Criminals can also develop zero-day malware themselves, although this is less common. In order to do this, they would require to have a great understanding of computer system security and exploits.
Another method that lawbreakers can acquire zero-day malware is by stealing it from a legitimate business or person. This can be done by hacking into a company's network and taking the malware, or by social engineering a business or individual into providing them the malware.
Finally, lawbreakers can find zero-day malware in the wild. When a security scientist discovers a brand-new vulnerability and writes a make use of for it, this normally happens. The researcher might then offer the make use of to a criminal group, or the exploit might be leaked online.