"it remains unclear how the actor acquired exploit information prior to disclosure."