U.S. sanctions Russian cyber broker Operation Zero over stolen defense zero-day exploits

Today, the Department of State announced the designations of one individual and two entities under the Protecting American Intellectual Property Act (PAIPA) in connection with theft of trade secrets from U.S. persons. Matrix LLC (AKA Operation Zero) is a Russian cyber-tools broker that publicly advertises itself as a reseller of cyber exploits to various customers, including the Russian government. From 2022 to 2025, Peter Williams, an Australian national, stole eight trade secret “zero-day exploits,” techniques that leverage software vulnerabilities for which there are no patches, from his employer, a U.S. defense contractor.

Background and Key Details

Those components were meant to be sold exclusively to the U.S. government and select allies. He sold these exploits to Operation Zero in exchange for $1.3 million in cryptocurrency payments. Sergey Sergeyevich Zelenyuk (Zelenyuk) is a Russian national and the director and sole owner of Operation Zero.

Moreover, zelenyuk established a UAE-based company under the name Special Technology Services LLC FZ (STS), anticipating that the new company would conduct business with various countries in Asia and the Middle East.  Zelenyuk’s effort to establish this company was likely aimed in part at circumventing U.S. sanctions imposed on Russian bank accounts. Operation Zero and Zelenyuk are foreign persons that knowingly engaged in. Benefitted from, significant theft of trade secrets of United States persons, which occurred on or after January 5, 2023, and is reasonably likely to result in, or has materially contributed to, a significant threat to the national security, foreign policy, or economic health or financial stability of the United States.

STS is an entity that is owned or controlled by. That has acted or purported to act for or on behalf of, directly or indirectly, Zelenyuk. Concurrently, the Department of Treasury is designating Zelenyuk and his company, Matrix LLC (doing business as Operation Zero), STS, as well as four associated individuals and entities pursuant to Executive Order (E.O.) 13694, as further amended by E.O. 14306.

Enforcement Actions and Impact

As a result of today’s action under E.O. 13694, as amended, all property and interests in property of those designated that are in the United States or that are in possession or control of a U.S. person are blocked. U.S. persons are generally prohibited from conducting business with sanctioned persons. Persons that engage in certain transactions or activities with those designated may expose themselves to sanctions risk. For complete details, refer to the official OFAC press release.

As a result of the designations under PAIPA, the sanctions specified in Section 2(b)(1)(A), (D), (H), (I). (J) of the statute apply with respect to Operation Zero and STS. Individuals designated under PAIPA are subject to the sanctions for individuals outlined in Section 2(b)(2) of the statute. For related coverage, see F-35 Fighter Jet Becomes $2 Trillion Disaster as Allies Abandon Costly Jet Amid Broken Promises.

Consequently, today’s action is being taken pursuant to the authorities under the Protecting American Intellectual Property Act (50 U.S.C. 1709) and Executive Order (E.O.) 13694, as amended. For further information, please submit a media inquiry, or visit our Cyber Sanctions page. For related coverage, see Europe Jolted as Portugal’s President Declares Trump “Objectively a Soviet Agent” Helping Moscow.

What This Means Going Forward

This development underscores the ongoing regulatory enforcement priorities of OFAC. Market participants and compliance professionals should monitor this matter closely.

TOP 10 TRENDING ON NEWSINTERPRETATION

Cyber Attacks on Space Infrastructure: Satellites, GPS and the Ground Systems Behind Them

From the Viasat KA-SAT hack to GPS jamming over the Baltic, a research guide to how attackers target satellites, navigation signals and ground stations, and why it matters on Earth.

How AI Agents Are Used in Cyber Attacks: From Assisted Hacking to AI-Orchestrated Espionage

Attackers now use AI agents to scan networks, write exploits and run extortion campaigns. A research guide to documented cases, including the first reported AI-orchestrated espionage campaign, and what defenders should do.

Cyber Attacks on AI and LLMs: How Attackers Target Large Language Models

Prompt injection, data poisoning, model theft and jailbreaks: a research guide to how attackers target AI systems and large language models, with real cases and defences.

French Supermarket Refrigeration Cyberattack: How Hacking the Cold Chain Can Endanger Lives

In October 2026 attackers heated refrigeration cabinets in hundreds of French supermarkets to as much as 50°C. No one was hurt, but the attack shows how hacking the cold chain can endanger lives through fire, food poisoning and spoiled medicines.

Cyberattacks on Nuclear Facilities: Stuxnet, Kudankulam and the Limits of Air Gaps

Stuxnet, the Davis-Besse worm and malware at India’s Kudankulam plant: what they show about cyber risk at nuclear facilities and the limits of air gaps.

Triton: When Hackers Target the Safety Systems That Prevent Industrial Disasters

The 2017 Triton attack targeted the safety systems that prevent industrial disasters. What happened, who was charged, and how plants protect their last line of defence.

Cybersecurity Risks in Smart Cities: When Connected Infrastructure Fails

How connecting traffic control, emergency alerts and utilities concentrates cyber risk in cities, what the Dallas and Atlanta incidents showed, and what governments recommend.

Weaponized Drones: Hijacking, GPS Spoofing and Emerging Cyber Warfare Risks

How drones can be hijacked, jammed or misled by GPS spoofing, what researchers have demonstrated, and why governments treat drone fleets as a security risk.

Ransomware Attacks on Hospitals: How Healthcare Cyberattacks Put Patients at Risk

How ransomware against hospitals and their suppliers delays care and endangers patients, what the Düsseldorf and WannaCry cases show, and what research says about deaths.

Operational blunder exposes massive Russian cyber espionage attack on Ukrainian prosecutors

A major cyberattack has compromised the email accounts of...

Cyber Attacks on Space Infrastructure: Satellites, GPS and the Ground Systems Behind Them

From the Viasat KA-SAT hack to GPS jamming over the Baltic, a research guide to how attackers target satellites, navigation signals and ground stations, and why it matters on Earth.

French Supermarket Refrigeration Cyberattack: How Hacking the Cold Chain Can Endanger Lives

In October 2026 attackers heated refrigeration cabinets in hundreds of French supermarkets to as much as 50°C. No one was hurt, but the attack shows how hacking the cold chain can endanger lives through fire, food poisoning and spoiled medicines.

Cyberattacks on Nuclear Facilities: Stuxnet, Kudankulam and the Limits of Air Gaps

Stuxnet, the Davis-Besse worm and malware at India’s Kudankulam plant: what they show about cyber risk at nuclear facilities and the limits of air gaps.

Triton: When Hackers Target the Safety Systems That Prevent Industrial Disasters

The 2017 Triton attack targeted the safety systems that prevent industrial disasters. What happened, who was charged, and how plants protect their last line of defence.

Cybersecurity Risks in Smart Cities: When Connected Infrastructure Fails

How connecting traffic control, emergency alerts and utilities concentrates cyber risk in cities, what the Dallas and Atlanta incidents showed, and what governments recommend.

Ransomware Attacks on Hospitals: How Healthcare Cyberattacks Put Patients at Risk

How ransomware against hospitals and their suppliers delays care and endangers patients, what the Düsseldorf and WannaCry cases show, and what research says about deaths.

FBI warns of AVrecon malware targeting outdated routers linked to proxy based cybercrime

A serious cybersecurity warning has been issued regarding commonly...

Related Articles

Popular Categories