In this day and age, it could also be well paid nation state hackers. It is well understood that places like the NSA actively seek out zero day exploits and use them to perform whatever operations they need to do. They don't report them to software devs that can patch them.