Treasury Sanctions Russian ‘Exploit’ Dealer Over Stolen US Cyber Instruments – Decrypt

The U.S. Treasury Division on Tuesday mentioned it has sanctioned a Russian dealer dealing in exploits, accused of promoting stolen U.S. authorities cyber instruments.

The sanctions focused Sergey Sergeyevich Zelenyuk and his St. Petersburg-based agency, Matrix LLC, also referred to as “Operation Zero.”

The sanctions mark the primary use of the Defending American Mental Property Act to handle the theft and sale of digital commerce secrets and techniques, in line with the Workplace of International Belongings Management.

“Zelenyuk and Operation Zero commerce in ‘exploits,’ items of code or methods that reap the benefits of vulnerabilities in a pc program to permit customers to achieve unauthorized entry, steal info, or take management of an digital gadget,” OFAC mentioned in a press release on Tuesday.

Operation Zero would then supply bounties to anybody who supplied exploits for U.S.-built software program, OFAC added.

Treasury additionally sanctioned Oleg Vyacheslavovich Kucherov, a suspected member of the Trickbot cybercrime gang, and Marina Evgenyevna Vasanovich, described as Zelenyuk’s assistant.

Launched in 2021, Operation Zero has provided multimillion-dollar bounties for vulnerabilities in working programs and encrypted messaging purposes.

Operation Zero didn’t disguise its bounties, lots of which had been overtly printed on X. One bounty submit in November provided as much as $500,000 for an exploit focusing on Apple’s iOS 26. A bounty from March 2025 provided as much as $4 million for Telegram “full chain” exploits.

Operation Zero’s shoppers are “Russian personal and authorities organizations solely,” for these searching for to buy “analysis, merchandise, and software program code within the discipline of offensive safety,” in line with a tough translation of the corporate’s web site.

“Zero-day acquisition is a well-liked and customary follow in lots of nations these days,” the corporate mentioned in its FAQ. “It’s not solely rather more profitable than working with bug bounties and distributors however extra secure as effectively,” including {that a} researcher who works with Operation Zero mustn’t need to commerce privateness and security for cash.

Operation Zero has stolen at the very least eight proprietary “cyber instruments” developed for the unique use of the U.S. authorities and choose allies, in line with the Treasury Division.

The U.S. State Division mentioned Tuesday in a separate assertion that the motion follows a Justice Division and FBI investigation into Peter Williams, an Australian nationwide and former worker of a U.S. protection contractor, who allegedly stole “eight commerce secret zero-day exploits” from 2022 by way of to 2025.

“These elements had been meant to be offered completely to the U.S. authorities and choose allies, the state division mentioned. “He offered these exploits to Operation Zero in change for $1.3 million in crypto funds.” Williams pleaded responsible in October of final 12 months to 2 counts of theft of commerce secrets and techniques.

Treasury mentioned the Russian firm has additionally labored to develop spyware and adware and AI-based instruments to extract private figuring out info and different delicate information. It has additionally used social media to recruit hackers and construct relationships with overseas intelligence companies.

The Treasury Division and Operation Zero didn’t instantly reply to Decrypt’s requests for remark.