Researcher: WMF Exploit Sold Underground for $4,000
Virus hunters combing through the wreckage of the zero-day WMF (Windows Metafile) attacks have found evidence that exploit code was being peddled by Russian hacker groups for $4,000 a pop. — The first sign of an exploit was traced …
Context & Ripple Effects
The WMF story has been escalating since late December 2005, when researchers flagged the Windows Metafile flaw as a zero-day exploit and counted more than 50 variants already circulating. By year's end, defenders' main complaint was uneven protection — antivirus vendors were still catching up on detection for the WMF flaw days into the outbreak.
This report adds an economic layer to that timeline: researchers tracing where the first exploit surfaced found evidence it was being sold by Russian hacker groups at $4,000 per copy before and during the attacks. That price tag reframes the outbreak from a single leaked bug into a paid product launch.
First-order effects
- Buyers of the $4,000 exploit get working code-execution capability against unpatched Windows machines immediately, while Microsoft and antivirus firms are still racing to patch and detect — the asymmetry that produced the 50-plus variant wave in the first place.
Second-order effects
- A functioning resale market pushes more criminal groups to acquire rather than write their own exploits, multiplying variant volume beyond what any single author would produce and stretching the inconsistent AV coverage defenders were already complaining about.
Third-order effects
- If exploit code reliably commands four-figure prices, vulnerability discovery becomes a revenue business rather than a research byproduct — pushing the industry toward formal markets for zero-days and hard questions about who is entitled to sell what they find.
The trend: Security flaws are becoming tradeable inventory, with underground pricing turning individual zero-day exploits into products whose distribution outpaces vendor response.