Treasury sanctions Russian zero-day broker accused of buying exploits stolen from US defense contractor
Source: TechCrunch
Operation Zero
- Company: Operation Zero (Russian firm, launched 2021)
- Notable offers:
- Up to $20 million for zero‑days in Android devices and iPhones – TechCrunch, Sep 2023
- Up to $4 million for zero‑days in Telegram – TechCrunch, Mar 2025
- Claimed clientele: Russian government and local organizations – official site
The Treasury’s Office of Foreign Assets Control (OFAC) said Operation Zero’s customers “could use the tools to launch ransomware attacks or engage in other malign activities.”
Founder: Sergey Zelenyuk – accused of selling exploits to foreign intelligence agencies, recruiting hackers, and developing relationships with foreign intelligence agencies via social media (Operation Zero has accounts on X and Telegram).
According to the Treasury, Operation Zero:
- Acquired at least eight proprietary cyber tools created for exclusive U.S. government use (stolen from a U.S. company)
- Sold those stolen tools to at least one unauthorized user
The sanctions coincide with an FBI investigation into Peter Williams, former general manager at Trenchant (U.S. defense contractor L3Harris). In October, Williams pleaded guilty to selling at least eight of L3Harris’s exploits to an unspecified Russian broker – later identified as Operation Zero.
Source: TechCrunch, Oct 2025
Additional Sanctioned Entities
| Entity | Location | Relationship to Operation Zero |
|---|---|---|
| Special Technology Services | United Arab Emirates | Affiliate company |
| Marina Evgenyevna Vasanovich | — | Assistant to Zelenyuk |
| Azizjon Makhmudovich Mamashoyev | — | Associated with Operation Zero; founder of Advance Security Solutions |
| Oleg Vyacheslavovich Kucherov | — | Alleged member of ransomware gang Trickbot |
All are being sanctioned under a 2022 federal law that allows the U.S. government to impose sanctions on individuals who commit “significant thefts of trade secrets.” – Full text of the law
- Kucherov – suspected member of the prolific ransomware gang Trickbot – previously sanctioned by the U.S. and the United Kingdom. – TechCrunch, Jul 2019 | Sanctions, Feb 2023 | More sanctions, Sep 2023
- Mamashoyev – founder of Advance Security Solutions, another zero‑day broker based in the UAE, also sanctioned today.
Advance Security Solutions launched last year, offering up to $20 million for zero‑days that could hack any smartphone via a text message, and high‑paying bounties for exploits in Android, iPhone, Windows, Chrome, and other popular software/hardware. – TechCrunch, Aug 2025
Contact Us
Do you have more information about Operation Zero or the market for zero‑days? We’d love to hear from you.
From a non‑work device, you can contact Lorenzo Franceschi‑Bicchierai securely:
- Signal: +1 917 257 1382
- Telegram / Keybase / Wire: @lorenzofb
- Email: lorenzo@techcrunch.com
Additional Context
- Peter Williams – former general manager at Trenchant (developer of hacking and surveillance tools for the U.S. government and Five Eyes partners: Australia, Canada, New Zealand, United Kingdom).
- The Treasury did not respond to a series of questions related to today’s sanctions.
- Operation Zero, Special Technology Services, and Zelenyuk are being sanctioned in parallel under the 2022 law mentioned above.
Responses
- Operation Zero and Zelenyuk did not respond to a request for comment.
- Kucherov, Mamashoyev, and Vasanovich could not be immediately reached for comment.
- When contacted by TechCrunch, a person operating an Advance Security Solutions chat account claimed—without evidence—that Mamashoyev is not the founder of the company.
About the Author
Lorenzo Franceschi‑Bicchierai is a Senior Writer at TechCrunch, covering hacking, cybersecurity, surveillance, and privacy.
- Email: lorenzo@techcrunch.com
- Signal: +1 917 257 1382
- Keybase / Telegram: @lorenzofb
[r/lorenzo-franceschi-bicchierai](https://www.reddit.com/r/lorenzo-franceschi-bicchierai/)