Mandiant: one-third of all hacker groups exploiting zero-days in 2021 were financially motivated criminals as opposed to government-backed cyberespionage groups
The most valuable hacking tools were once the domain of governments. Not anymore. — Organized cybercriminals with money …
Context & Ripple Effects
For most of the last decade, zero-day exploitation read as a state signature: FireEye's global tracking found it could tie dozens of zero-days used between 2012 and 2019 to state-sponsored operations, and Trend Micro's breach data framed hacking and malware as a quarter of incidents over ten years. Mandiant's new split — one-third of the groups burning zero-days in 2021 were financially motivated criminals rather than espionage outfits — marks the point where the most expensive class of exploit stopped being a government monopoly.
The money side of that shift was already visible: Chainalysis had traced nearly $1B in cryptocurrency theft to just two hacker groups, showing organized criminal crews with revenue streams deep enough to bid for top-tier tooling.
First-order effects
- Defenders lose a cheap triage heuristic: a zero-day in the wild no longer implies a nation-state adversary, so incident responders at firms like Mandiant must treat criminal-grade ransomware and extortion crews as capable of the same entry techniques as espionage units.
- Criminal groups with crypto proceeds join the demand side for elite exploits, competing with intelligence agencies for the same limited supply of undisclosed vulnerabilities.
Second-order effects
- Sustained criminal demand should push up prices across the vulnerability brokerage market, and vendors face faster patch pressure since exploits they assumed would be used sparingly by states now get weaponized at scale for extortion.
- The pattern extends beyond zero-days: researchers later found the Lapsus$ crew succeeding against weaknesses that were never even valuable enough for state or established criminal actors to bother exploiting.
Third-order effects
- Attribution doctrine built on capability-as-signal erodes: if a third of zero-day users are criminals, expensive tradecraft stops identifying who is behind an intrusion, raising the value of payment-infrastructure and cash-flow tracing of the kind Chainalysis performs.
- Threat-intelligence firms' product shifts from naming state actors toward profiling criminal business models — group economics, monetization chains, and affiliate structures become the analytical core.
The trend: Elite offensive capability is commoditizing downward: financially motivated crime syndicates are closing the gap with state-sponsored hackers on the most expensive tools in the market.