US Sanctions Exploit Brokers Behind Theft of Government Cyber Tools
On February 24, 2026, the United States Department of the Treasury's Office of Foreign Assets Control imposed sanctions on Russian national Sergey Zelenyuk and his company, Operation Zero, along with several affiliates. This action targets a network…
On February 24, 2026, the United States Department of the Treasury's Office of Foreign Assets Control imposed sanctions on Russian national Sergey Zelenyuk and his company, Operation Zero, along with several affiliates. This action targets a network involved in trafficking stolen government cyber tools, aiming to protect national security and American intellectual property from cyber threats.
Stolen Proprietary Tools and Broker Operations
Operation Zero functions as an exploit broker, offering financial rewards to researchers for disclosing vulnerabilities in U.S. software. The organization recently acquired at least eight sensitive, proprietary cyber tools initially developed for the U.S. government and allied nations. These tools were stolen by Peter Williams, a former employee of a U.S. defense contractor, who exchanged them with Operation Zero for cryptocurrency between 2022 and 2025.
Zelenyuk subsequently marketed these stolen tools to intelligence agencies in non-NATO countries, facilitating the potential for ransomware attacks and data extraction from language models and messaging applications. In response, the U.S. government imposed sanctions under the Protecting American Intellectual Property Act, marking the first enforcement action under this legislation.
Operation Zero functions as an exploit broker, offering financial rewards to researchers for disclosing vulnerabilities in U.S.
The sanctions extend to dismantle Zelenyuk's support network in Russia, the United Arab Emirates, and Uzbekistan. This includes his assistant, Marina Vasanovich, and Special Technology Services, a UAE-based company under Zelenyuk's control. Connections to cybercrime syndicates were also identified, including Oleg Kucherov, linked to the Trickbot gang, responsible for ransomware attacks on American hospitals.
Azizjon Mamashoyev, another key figure, was sanctioned for creating Advance Security Solutions, an exploit brokerage similar to Operation Zero. As a result, all financial assets held by these entities in the United States are frozen, and American citizens are prohibited from engaging in business with them.
Based on reporting by GBHackers.