U.S. Sanctions Operation Zero Over Sale of Stolen Government Cyber Tools
Summary
OFAC sanctioned Operation Zero, its owner Sergey Zelenyuk, and associates over exploit brokerage. Treasury says the firm acquired at least eight stolen U.S. government cyber tools; former employee Peter Williams pleaded guilty to stealing and selling them.
Key points
- OFAC designated Russian national Sergey Zelenyuk and Matrix LLC, which operates as Operation Zero, over cyber-exploit acquisition and sales.
- Treasury says Operation Zero acquired at least eight proprietary tools made for U.S. government use that were stolen from a U.S. company.
- Former employee Peter Williams pleaded guilty to stealing the tools between 2022 and 2025 and selling them to Operation Zero for cryptocurrency.
- Treasury says Operation Zero sold the stolen tools to at least one unauthorized user and does not disclose discovered exploits to affected software vendors.
- Operation Zero has marketed exploits to customers from non-NATO countries, according to the article.
- The sanctions also target associates and companies in Russia, the UAE, and Uzbekistan, including Oleg Kucherov, whom Treasury describes as a suspected Trickbot member.
Article Details
- Event Type
- OFAC sanctions designating Sergey Sergeyevich Zelenyuk and Matrix LLC, operating as Operation Zero, over exploit brokerage activities, and targeting associated individuals and companies.
- Impact
- Treasury alleges Operation Zero acquired at least eight proprietary cyber tools stolen from a U.S. company and sold them to an unauthorized customer. Peter Williams pleaded guilty to stealing the tools and selling them to Operation Zero. The article says the firm withholds discovered exploits from software vendors and markets them to non-NATO customers; Treasury warns customers could use the tools for ransomware or other malign activity.
Threat Actors
Oleg Vyacheslavovich KucherovThe article identifies Kucherov as a suspected member of the Trickbot cybercrime gang; his membership is presented as suspected, not confirmed.Operation ZeroTreasury alleges Operation Zero acquired at least eight proprietary cyber tools stolen from a U.S. company and sold them to at least one unauthorized user. The article says the firm withholds discovered exploits from vendors and markets them to customers in non-NATO countries.Peter WilliamsThe article reports that Williams pleaded guilty to stealing proprietary cyber tools from his former employer between 2022 and 2025 and selling them to Operation Zero for cryptocurrency.Sergey Sergeyevich ZelenyukOFAC designated Zelenyuk over his role in Operation Zero. Treasury alleges the firm acquired and distributed cyber exploits and stolen U.S. government tools.Trickbot GroupThe article describes Trickbot as a cybercrime gang associated with Oleg Vyacheslavovich Kucherov, whose membership is suspected, and says its malware suite has been used to launch ransomware attacks.
Malware
Countries
RussiaSanctions also target a network of associates and companies across Russia, the UAE, and Uzbekistan, including a suspected Trickbot affiliate.UAESanctions also target a network of associates and companies across Russia, the UAE, and Uzbekistan, including a suspected Trickbot affiliate.United Stateshis firm Matrix LLC (operating as Operation Zero) for acquiring and selling cyber exploits that threaten U.S.UzbekistanSanctions also target a network of associates and companies across Russia, the UAE, and Uzbekistan, including a suspected Trickbot affiliate.
Industries
CybersecurityThe firm operates by offering “millions of dollars in bounties to cybersecurity researchers and others for the development or acquisition of exploits targeting commonly used software, including U.S.-built operatingGovernmentgovernment cyber tools stolen by former employee Peter Williams and sold them to unauthorized customers while marketing exploits to nonâNATO intelligence agencies and associating with actors linked to Trickbot.