For reasons still unknown, exploit broker Zerodium, who mainly sells their services to government agencies and institutions in the EU and North America, has stated on Twitter that they’ve been looking to purchase Windows client zero-day flaws in the ExpressVPN, NordVPN, and Surfshark VPN services. Specifically, Zerodium is looking for any types of exploits that could lead to user information disclosure, escalation of privileges within a system, and remote code execution. Zerodium has decided to acquire as many of these exploits as possible due to the increasing prevalence of VPN clients used for location spoofing by threat-actors attempting to compromise vulnerable systems. Spokespersons from the three VPN services have not made any official statements at this time regarding Zerodium, and the Ankura CTAPT will monitor this situation, and provide relevant updates to our readers as the matter develops.