Treasury Sanctions Russian ‘Exploit’ Broker Over Stolen US Cyber Tools

The U.S. Treasury Division on Tuesday stated it has sanctioned a Russian dealer dealing in exploits, accused of promoting stolen U.S. authorities cyber instruments.

The sanctions focused Sergey Sergeyevich Zelenyuk and his St. Petersburg-based agency, Matrix LLC, also called “Operation Zero.”

The sanctions mark the primary use of the Defending American Mental Property Act to handle the theft and sale of digital commerce secrets and techniques, in line with the Workplace of Overseas Belongings Management.

“Zelenyuk and Operation Zero commerce in ‘exploits,’ items of code or methods that make the most of vulnerabilities in a pc program to permit customers to achieve unauthorized entry, steal info, or take management of an digital gadget,” OFAC stated in a statement on Tuesday.

Operation Zero would then supply bounties to anybody who supplied exploits for U.S.-built software program, OFAC added.

Treasury additionally sanctioned Oleg Vyacheslavovich Kucherov, a suspected member of the Trickbot cybercrime gang, and Marina Evgenyevna Vasanovich, described as Zelenyuk’s assistant.

Launched in 2021, Operation Zero has provided multimillion-dollar bounties for vulnerabilities in working techniques and encrypted messaging purposes.

Operation Zero didn’t cover its bounties, a lot of which had been brazenly revealed on X. One bounty put up in November provided as much as $500,000 for an exploit focusing on Apple’s iOS 26. A bounty from March 2025 provided as much as $4 million for Telegram “full chain” exploits.

Operation Zero’s purchasers are “Russian personal and authorities organizations solely,” for these in search of to buy “analysis, merchandise, and software program code within the area of offensive safety,” in line with a tough translation of the corporate’s web site.

“Zero-day acquisition is a well-liked and customary apply in lots of nations these days,” the corporate stated in its FAQ. “It’s not solely far more profitable than working with bug bounties and distributors however extra protected as effectively,” including {that a} researcher who works with Operation Zero shouldn’t should commerce privateness and security for cash.

Operation Zero has stolen a minimum of eight proprietary “cyber instruments” developed for the unique use of the U.S. authorities and choose allies, in line with the Treasury Division.

The U.S. State Division stated Tuesday in a separate statement that the motion follows a Justice Division and FBI investigation into Peter Williams, an Australian nationwide and former worker of a U.S. protection contractor, who allegedly stole “eight commerce secret zero-day exploits” from 2022 by means of to 2025.

“These parts had been meant to be bought solely to the U.S. authorities and choose allies, the state division stated. “He bought these exploits to Operation Zero in alternate for $1.3 million in crypto funds.” Williams pleaded responsible in October of final yr to 2 counts of theft of commerce secrets and techniques.

Treasury stated the Russian firm has additionally labored to develop adware and AI-based instruments to extract private figuring out info and different delicate information. It has additionally used social media to recruit hackers and construct relationships with international intelligence businesses.

The Treasury Division and Operation Zero didn’t instantly reply to Decrypt’s requests for remark.