There are a couple of ways that bad guys can get zero-day malware:
1. They can buy it on the black market.
2. They can produce it themselves.
3. They can steal it from a legitimate business or person.
4. They can find it in the wild.
The most typical method that wrongdoers obtain zero-day malware is by purchasing it on the black market. There are a number of black markets that offer zero-day malware, and the rates can vary depending upon the demand and the sophistication of the malware.
Wrongdoers can also produce zero-day malware themselves, although this is less typical. In order to do this, they would need to have an excellent understanding of computer security and exploits.
Another manner in which lawbreakers can acquire zero-day malware is by taking it from a genuine company or person. This can be done by hacking into a company's network and taking the malware, or by social engineering a company or person into providing them the malware.
Wrongdoers can discover zero-day malware in the wild. https://zerogov.net/?p=826 This generally occurs when a security researcher finds a brand-new vulnerability and writes an exploit for it. The scientist may then sell the exploit to a criminal group, or the make use of might be leaked online.