There are a couple of manner ins which bad guys can obtain zero-day malware:
1. They can buy it on the black market.
2. They can produce it themselves.
3. They can steal it from a genuine business or individual.
4. https://tourismcrisis.org/?p=330 They can discover it in the wild.
The most typical way that criminals obtain zero-day malware is by buying it on the black market. There are a variety of black markets that offer zero-day malware, and the prices can differ depending on the need and the elegance of the malware.
Wrongdoers can also develop zero-day malware themselves, although this is less typical. In order to do this, they would require to have a mutual understanding of computer system security and exploits.
Another manner in which bad guys can get zero-day malware is by taking it from a legitimate business or person. This can be done by hacking into a business's network and taking the malware, or by social engineering a business or individual into offering them the malware.
Crooks can discover zero-day malware in the wild. This typically takes place when a security researcher discovers a brand-new vulnerability and composes an exploit for it. The scientist may then offer the exploit to a criminal group, or the exploit might be dripped online.