Treasury sanctions Russian zero-day broker accused of buying exploits stolen from U.S. defense contractor

In a significant move to safeguard national security, the U.S. government announced on Tuesday that it has imposed sanctions on two companies involved in the acquisition and resale of zero-day exploits, along with their founders and associates. According to officials from the U.S. Treasury, these brokers are seen as a substantial threat to the nation’s security, foreign policy, and economic integrity. The first company targeted is Operation Zero, a Russian entity that was established in 2021. The firm garnered attention earlier this year when it publicly offered up to $20 million for zero-day vulnerabilities in both Android devices and iPhones, and later extended offers of up to $4 million for exploits in the messaging platform Telegram. They claim to exclusively collaborate with the Russian government and local organizations. The Treasury's Office of Foreign Assets Control (OFAC) highlighted that Operation Zero's clientele could potentially leverage these exploits for malicious activities, including ransomware attacks. The sanctions also extend to the firm’s founder, Sergey Zelenyuk, who has been accused of selling exploits to foreign intelligence agencies and attempting to develop spyware and hacking technologies. Authorities allege that Zelenyuk has been actively recruiting hackers and forging connections with foreign intelligence through social media platforms, including X and Telegram. Furthermore, the Treasury's announcement revealed that Operation Zero had acquired at least eight proprietary cyber tools specifically designed for use by the U.S. government and its allies, which were stolen from a U.S. company and subsequently sold to unauthorized users. These sanctions align with an ongoing FBI investigation into Peter Williams, a former employee of U.S. defense contractor L3Harris. In October, Williams admitted guilt to selling several of the company’s exploits to a Russian broker, which the Treasury now confirms to be Operation Zero. In addition to Zelenyuk, the U.S. Treasury also sanctioned an affiliate company based in the UAE, known as Special Technology Services, along with Zelenyuk’s assistant, Marina Evgenyevna Vasanovich, and two individuals linked to Operation Zero—Azizjon Makhmudovich Mamashoyev and Oleg Vyacheslavovich Kucherov. The latter is suspected of connections to the notorious Trickbot ransomware gang, which has faced previous sanctions from both the U.S. and the U.K. Mamashoyev is alleged to be the founder of Advance Security Solutions, another zero-day broker that surfaced last year, offering lucrative rewards for exploits capable of infiltrating various smartphone types through text messages. This broker also sought bounties for hacking tools across widely used software and hardware platforms. As the situation unfolds, neither Operation Zero nor Zelenyuk has provided comments regarding the sanctions. Attempts to reach Kucherov, Mamashoyev, and Vasanovich have also been unsuccessful. Meanwhile, a representative from an Advanced Security Solutions chat account claimed, without substantiation, that Mamashoyev is not actually the company's founder.