Skip to content
Ctrl K

Volodya / BuggiCorp

Not a group, not a program: a full-time freelance exploit author, active from at least 2015, whose Windows kernel LPEs were attributed not by infrastructure or campaign metadata but by handwriting. Check Point fingerprinted eleven exploits across five years by coding style alone, and the same pen had sold to APTs and ransomware crews alike.

Verdict basis

cited, as of 2026-10-02, to Check Point Research's "Graphology of an Exploit" (2020, Itay Cohen and Eyal Itkin), which is the primary attribution study, plus Kaspersky and ESET tracking cited within it. CVE attributions below follow Check Point's conservative standard: a bug counts as a zero-day only where a vendor publicly attributed the in-the-wild use.

Who

Volodya, previously advertising as BuggiCorp on the Exploit[.]in forum, is an exploit developer believed to have been active since at least 2015, with PDB paths in his builds referencing volodimir_8 and volodimir_65. The famous starting point is the May 2016 BuggiCorp advertisement: a Windows 0-day, starting price $95,000, believed to be CVE-2016-7255. Kaspersky later reported prices reaching $200,000 for his Windows LPE zero-days.

Where Nightmare-Eclipse drops exploits and Sacco sells tooling around them, Volodya is the purest expression of the seller: the exploit itself is the product, and the product is good enough that its author is identifiable by style the way a novelist is.

The signature: an API, not an artifact

The body of work has a single calling card. Every exploit exposes one entry point:

bool elevate(int target_pid)

No shellcode, no injection, no options. The exploit grants SYSTEM to one process ID and returns. This is a component in the commercial sense: something a buyer's loader calls, not something a buyer operates. Around that API, the handwriting accumulates:

  • A habitual Sleep(200) at exploit start, present in nine samples, later dropped.
  • OS fingerprinting by parsing ntdll.dll NT headers, ignoring service packs and server/client distinctions, unlike his market competitor PlayBit.
  • Kernel address leak through the HMValidateHandle technique reached via isMenu(), in every exploit but one, exactly as public tutorials describe it.
  • Token elevation performed from user mode: an arbitrary read/write primitive walking the process list and editing the token, never executing kernel code. Eight of eleven exploits.
  • Recurring strings and PDB paths: MyWindow, MyClass_56, findme1.
  • A persistent bug: a misaligned reference-count mask in 32-bit builds.

The user-mode token walk is the technically interesting habit. It sidesteps SMEP entirely, at a time when competitors were building kernel ROP chains to satisfy it: instead of executing code under kernel mode, he never executes code in kernel mode at all. Read, edit, done. It is the same data-only instinct that runs from FudModule to the DOG family, arrived at a decade early for commercial reasons: reliability is what a buyer pays for twice.

The catalogue

Tier CVEs Notes
Confirmed 0-days CVE-2016-0167, CVE-2016-7255, CVE-2017-0263, CVE-2019-0859 Win32k UAF and memory corruption family
Attributed, conservatively CVE-2019-1132, CVE-2016-0165, CVE-2018-8641 PDB and technique match, sample gaps
1-days, resold CVE-2015-2546, CVE-2016-0040, CVE-2017-0001, CVE-2019-1458 Recycled to multiple crimeware buyers

The customers split by tier, and the split is the market structure in one table: the zero-days went to APTs (APT28/Sednit on CVE-2016-7255 and CVE-2017-0263; Turla on CVE-2017-0001; Buhtrap on CVE-2019-1132 and CVE-2015-2546), while the 1-days spread across Ursnif, Dreambot, GandCrab, Cerber, Maze and Magniber. Exclusivity is the expensive product; recycled patch-diffs are the volume product.

One detail deserves its own line: Volodya once sold a buyer what both sides called CVE-2016-0165, but the exploit actually targeted a different bug bundled in the same patch. Patch-diff ambiguity is a market hazard, and the seller who can navigate it holds the advantage over the seller who cannot.

What it defeats, and what stops it

Working in the 2016-2019 era, his techniques predate most of this site's Targets section: the HMValidateHandle leak class is the ancestor of today's KASLR leak inventory, and the user-mode token walk is the commercial ancestor of token swapping as a data-only discipline. The bug surface itself is the corpus's Win32k family, the most-picked-over driver of that decade, which is precisely why his catalogue reads as a tour of it.

What stopped Volodya was not a mitigation but economics and age: the win32k 0-day supply thinned as Microsoft hardened the surface, and the market's center of gravity moved to brokerages and spyware vendors. The handwriting method that identified him is what outlived him; it is now a standard attribution tool.

Detection (of the era, and of the type)

Historically: the Sleep(200) pause, HMValidateHandle calls reached through isMenu(), and single-purpose binaries exporting elevate were signature-grade. The type-level lesson survives: a buyer's loader tells you what the seller's API looked like, so loader code is attribution evidence even when the seller never touches a victim.

Assessment

Volodya is the reference profile for the seller tier: technically conservative, commercially sophisticated, identifiable by discipline rather than by flair. The one-entry API and the user-mode token walk show a developer optimizing for the buyer's success rate, not for elegance, five years before "reliability over stealth" became the ransomware industry's stated requirement. Read next to PlayBit, his stylistic opposite, and the CLFS contractor, his industrial-era successor.

Sources

Itay Cohen and Eyal Itkin, Check Point Research, "Graphology of an Exploit" (2020), the fingerprinting study and CVE attribution base; Kaspersky and ESET seller tracking as cited therein; the May 2016 BuggiCorp Exploit[.]in advertisement.