Sanctions on Russian exploit broker Operation Zero for stolen U.S. cyber tools

Sanctions on Russian exploit broker Operation Zero for stolen U.S. cyber tools were announced by the U.S. Treasury Department, which designated Sergey Sergeyevich Zelenyuk and Matrix LLC (also known as Operation Zero), along with Oleg Vyacheslavovich Kucherov and Marina Evgenyevna Vasanovich, for trading stolen U.S. government cyber tools. The department said this action targets the broker, its associated entity, and named individuals for their roles in offering and buying exploits. This is the first use of the Protecting American Intellectual Property Act against theft and sale of digital trade secrets.

Operation Zero’s business focuses on trading in “exploits,” which are techniques that exploit software vulnerabilities to gain unauthorized access or control. The company offered bounties for vulnerabilities in U.S.-built software, with notable bounties on Apple iOS 26 at $500,000 and Telegram “full chain” exploits at $4 million.

Clients were described as “Russian private and government organizations only,” seeking offensive security tools. According to quotes, zero-day acquisition is both lucrative and safer than traditional bug bounties, being a “common practice in many countries nowadays.”

The State Department said the action followed a Justice Department and FBI investigation that found Operation Zero had stolen at least eight proprietary cyber tools developed for exclusive use of the U.S. government and select allies. The investigation identified Peter Williams, an Australian national and former employee of a U.S. defense contractor, who allegedly stole eight trade secret zero-day exploits from 2022 through 2025. Williams sold those exploits to Operation Zero in exchange for $1.3 million in crypto payments. He pleaded guilty in October of last year to two counts of theft of trade secrets. The Justice Department and FBI conducted the investigation and the State Department linked it to the Treasury action.

The U.S. Treasury’s sanctions action targeted Operation Zero and affiliated individuals and entities for trading stolen U.S. cyber tools. Officials invoked newly applied legal authorities to address digital trade secret theft, noting cross-border law enforcement involvement and international implications. The move signals wider efforts to curb illicit cyber markets and protect proprietary technologies internationally through coordinated measures and sustained diplomacy.