Treasury sanctions Russian zero-day broker accused of buying exploits stolen from U.S. defense contractor
Published: (February 24, 2026 at 02:01 PM EST)
2 min read
Source: TechCrunch
Source: TechCrunch
Companies and individuals sanctioned
| Entity | Role / Description | Sanction details |
|---|---|---|
| Operation Zero | Russian firm launched in 2021; claims to work exclusively with the Russian government and local organisations. | - Offered up to $20 M for Android/iPhone zero‑days (Sept 2023). - Later offered up to $4 M for Telegram zero‑days (Mar 2025). - Accused of acquiring at least eight proprietary cyber tools stolen from a U.S. company and selling them to unauthorized users. |
| Sergey Zelenyuk | Founder of Operation Zero | Accused of selling exploits to foreign intelligence agencies, recruiting hackers, and developing relationships with foreign intel via social media (X & Telegram). |
| Special Technology Services | Affiliate company based in the United Arab Emirates (UAE) | Sanctioned alongside Operation Zero and Zelenyuk. |
| Marina Evgenyevna Vasanovich | Assistant to Zelenyuk | Sanctioned. |
| Azizjon Makhmudovich Mamashoyev | Alleged associate of Operation Zero; founder of Advance Security Solutions (UAE) | Sanctioned. |
| Oleg Vyacheslavovich Kucherov | Russian national; suspected member of the ransomware gang Trickbot | Sanctioned. |
| Advance Security Solutions | UAE‑based zero‑day broker (founded by Mamashoyev) | Launched in 2024, offering up to $20 M for zero‑days that could hack any smartphone via text message; also offered bounties for Android, iPhone, Windows, and Chrome exploits. |
Note: The sanctions are being applied under a 2022 federal law that allows the U.S. government to sanction anyone who commits “significant thefts of trade secrets.”
Related investigations
- The Treasury said the sanctions against Operation Zero and Zelenyuk coincide with an FBI investigation into Peter Williams, former general manager at Trenchant (a U.S. defense contractor).
- In October 2025, Williams pleaded guilty to selling at least eight of L3Harris’s exploits to an unspecified Russian broker – later identified by the Treasury as Operation Zero.
Contact us
Do you have more information about Operation Zero or the market for zero‑days? We’d love to hear from you.
From a non‑work device, you can contact Lorenzo Franceschi‑Bicchierai securely:
- Signal: +1 917 257 1382
- Telegram / Keybase / Wire:
@lorenzofb - Email: lorenzo@techcrunch.com
About the author
Lorenzo Franceschi‑Bicchierai is a Senior Writer at TechCrunch, covering hacking, cybersecurity, surveillance, and privacy.
You can verify outreach from Lorenzo by emailing lorenzo@techcrunch.com, sending an encrypted message on Signal (+1 917 257 1382), or contacting him on Keybase/Telegram (@lorenzofb).
[Orenzo Franceschi Bicchierai](/orenzo-franceschi-bicchierai/)