The U.S. Treasury Department on Tuesday said it has sanctioned a Russian broker dealing in exploits, accused of selling stolen U.S. government cyber tools.
The sanctions targeted Sergey Sergeyevich Zelenyuk and his St. Petersburg-based firm, Matrix LLC, also known as “Operation Zero.”
The sanctions mark the first use of the Protecting American Intellectual Property Act to address the theft and sale of digital trade secrets, according to the Office of Foreign Assets Control.
Operation Zero would then offer bounties to anyone who provided exploits for U.S.-built software, OFAC added.
Treasury also sanctioned Oleg Vyacheslavovich Kucherov, a suspected member of the Trickbot cybercrime gang, and Marina Evgenyevna Vasanovich, described as Zelenyuk’s assistant.
Launched in 2021, the St. Petersburg-based Operation Zero has offered multimillion-dollar bounties for vulnerabilities in operating systems and encrypted messaging applications.
Operation Zero’s clients are “Russian private and government organizations only,” for those seeking to purchase “research, products, and software code in the field of offensive security,” according to a rough translation of the company’s website.
“Zero-day acquisition is a popular and common practice in many countries nowadays,” the company said in its FAQ. “It’s not only much more lucrative than working with bug bounties and vendors but more safe as well,” adding that a researcher who works with Operation Zero should not have to trade privacy and safety for money.
Operation Zero has stolen at least eight proprietary “cyber tools” developed for the exclusive use of the U.S. government and select allies, according to the Treasury Department.
“Those components were meant to be sold exclusively to the U.S. government and select allies, the state department said. “He sold these exploits to Operation Zero in exchange for $1.3 million in crypto payments.” Williams pleaded guilty in October of last year to two counts of theft of trade secrets.
Treasury said the Russian company has also worked to develop spyware and AI-based tools to extract personal identifying information and other sensitive data. It has also used social media to recruit hackers and build relationships with foreign intelligence agencies.
The Treasury Department and Operation Zero did not immediately respond to Decrypt’s requests for comment.
