\n<\/p>\n
The U.S. government announced<\/a> on Tuesday sanctions against two companies that acquire and resell zero-day exploits<\/a>, as well as sanctioning their founders and their associates.<\/p>\n Officials with the U.S. Treasury told TechCrunch that the government was imposing sanctions against the brokers of zero-days \u2014 security vulnerabilities in software that are unknown to its developer but can be abused to hack people \u2014 as they pose a threat to U.S. national security, foreign policy, and economy.\u00a0<\/p>\n The first sanctioned company is Operation Zero, a Russian firm that launched in 2021. The company made headlines in 2023 when it announced that it was offering<\/a> up to $20 million for zero-days in Android devices and iPhones, and later announced that it was offering up to $4 million<\/a> for zero-days in Telegram. The company claims<\/a> to work exclusively with the Russian government and local organizations.<\/p>\n The Treasury\u2019s Office of Foreign Assets Control (OFAC) said that Operation Zero\u2019s customers \u201ccould use the tools to launch ransomware attacks or engage in other malign activities.\u201d<\/p>\n The Treasury said it\u2019s also sanctioning the company\u2019s founder, Sergey Zelenyuk, who officials accused of selling exploits to foreign intelligence agencies and who say he sought to develop spyware and hacking technologies. The Treasury said Zelenyuk engaged in recruiting hackers and developing relationships with foreign intelligence agencies through social media. (Operation Zero has accounts on both X and Telegram.)<\/p>\n According to the Treasury, Operation Zero acquired \u201cat least eight proprietary cyber tools, which were created for the exclusive use of the U.S. government and select allies and which were stolen from a U.S. company,\u201d and then \u201csold those stolen tools to at least one unauthorized user.\u201d\u00a0<\/p>\n The Treasury said that the sanctions against Operation Zero and Zelenyuk coincide with an FBI investigation into Peter Williams, who worked for U.S. defense contractor L3Harris. In October, Williams pleaded guilty to selling at least eight of the company\u2019s exploits<\/a> to an unspecified Russian broker.\u00a0<\/p>\n The Treasury now says that the broker was Operation Zero, something that the government had not previously confirmed.<\/p>\n \nDo you have more information about Operation Zero? Or the market for zero-days? We\u2019d love to hear from you. From a non-work device, you can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram, Keybase and Wire @lorenzofb, or by email<\/a>.<\/a>\t\t<\/div>\n Williams was the general manager at Trenchant, which develops hacking and surveillance tools for the U.S. government and some of its top intelligence partners, including Australia, Canada, New Zealand, and the United Kingdom \u2014 the so-called alliance of Five Eyes countries.\u00a0<\/p>\n The Treasury did not respond to a series of questions related to today\u2019s sanctions.\u00a0<\/p>\n Along with taking action against Zelenyuk, the U.S. Treasury is sanctioning an affiliate company based in the United Arab Emirates called Special Technology Services, as well as Zelenyuk\u2019s assistant, Marina Evgenyevna Vasanovich, and two people associated with the company, Azizjon Makhmudovich Mamashoyev and Oleg Vyacheslavovich Kucherov, who have allegedly worked with Operation Zero.\u00a0<\/p>\n Operation Zero, Special Technology Services, and Zelenyuk are being sanctioned in parallel under a 2022 federal law<\/a> that allows the U.S. government to impose sanctions on someone who committed \u201csignificant thefts of trade secrets,\u201d per the Treasury.<\/p>\n The Treasury says Kucherov, a Russian national, is suspected of being a member of the prolific ransomware gang TrickBot<\/a>, whose alleged members were previously<\/a> sanctioned<\/a> by the U.S. and the United Kingdom.\u00a0<\/p>\n Mamashoyev is allegedly the founder of Advance Security Solutions, another zero-day broker based in the UAE, which was also sanctioned today.<\/p>\nContact Us<\/h4>\n