// Exploit Acquisition Program
We Acquire High-Value
Zero-Day Capabilities
IRIS C2 operates one of the world's most competitive private vulnerability acquisition programs. We acquire individual exploit primitives, partial chains, and full capabilities—paying premium prices for research at every stage of development.
// Program Overview
Premium Payouts for Premium Research
Unlike programs that only acquire complete exploit chains, we actively purchase individual primitives, partial chains, and standalone capabilities. A sandbox escape, kernel info leak, or type confusion primitive is valuable to us—even without a full chain.
Payouts range from $10,000 to $7 million USD depending on the primitive type, target platform, and reliability. Individual primitives are our most frequent acquisitions.
All submissions are handled with strict operational security. We offer multiple secure communication channels and can accommodate researchers with specific anonymity requirements.
// Acquisition Scope
Target Platforms & Payouts
We acquire exploits across all major platforms. Payouts listed are ranges—final amounts depend on reliability, stealth, and operational constraints.
Mobile
up to $7M USDPrices are indicative maximums. Actual payouts depend on exploit quality, reliability, stealth characteristics, and current market demand. Partial chains and individual components may also be considered.
// Requirements
What We're Looking For
We Accept
- ›Individual primitives (info leaks, type confusions, UAFs)
- ›Partial chains and sandbox escapes
- ›Full exploit chains (highest payouts)
- ›Zero-days with no prior disclosure
- ›Exclusive rights (not sold elsewhere)
- ›Current versions of target software
We Don't Accept
- ›Theoretical or unproven vulnerabilities
- ›Previously disclosed or patched bugs
- ›Non-exclusive or previously sold exploits
- ›Denial of service only vulnerabilities
- ›Exploits requiring physical access
- ›Social engineering or phishing kits
// How It Works
Submission Process
Our process is designed to protect both parties. You never send full exploit code until terms are agreed and contracts signed.
Initial Contact
Submit a brief technical summary through our secure portal. Include target, vulnerability class, and proof of exploitability. No full exploit code required at this stage.
Technical Evaluation
Our research team reviews the submission and assesses impact, reliability, and operational value. We respond within 72 hours with a preliminary offer or questions.
Negotiation & Agreement
If aligned, we negotiate final terms and execute a formal acquisition agreement covering exclusivity, payment terms, and confidentiality obligations.
Full Disclosure
You provide the complete exploit package: source code, technical writeup, root cause analysis, and exploitation methodology. Our team performs validation testing.
Payment
Upon successful validation, payment is released via your preferred method—wire transfer, cryptocurrency, or structured installments for high-value acquisitions.
Ready to Submit?
Send a brief, non-technical summary of your capability to our acquisitions team. Include the target platform, exploit type, and any constraints. Do not include full technical details in your initial contact.
exploits@IRISC2.comPGP keys available upon request.