U.S. Treasury sanctions Russia's "Zero Day" operation: Exposure of stolen U.S. government cyber tools case

The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) announced on February 25th sanctions against Russian exploitation broker Sergei Zelenyuk and his St. Petersburg company Matrix LLC (also known as “Operation Zero”). They are accused of selling stolen U.S. government proprietary network tools, marking the first law enforcement case under the “Protecting American Intellectual Property Act” to target digital trade secrets theft.

Operation Zero’s Operations and Sanctioned Entities

(Source: U.S. Department of the Treasury)

“Operation Zero” was launched in 2021, employing a public bounty system to purchase security vulnerabilities targeting mainstream operating systems and encrypted communication apps. Multiple bounties have been publicly posted on the X platform. Known rewards include $500,000 for 26 iOS vulnerabilities (November 2025) and $4 million for a complete attack chain vulnerability in Telegram (March 2025).

OFAC states that the exploits sold by “Operation Zero” enable attackers to gain unauthorized access, steal information, or remotely control targeted systems. The client base is explicitly limited to “private and government organizations in Russia,” focusing on offensive security research and software tools.

The sanctions also target two individuals: Oleg Vyacheslavovich Kucherov, suspected member of the Trickbot cybercriminal group, and Marina Evgenyevna Vasanovich, described as Zelenyuk’s assistant.

Australian Contractor Data Theft Case: $1.3 Million in Cryptocurrency as Key Evidence

The sanctions stem from investigations by the U.S. Department of Justice and FBI into Australian citizen Peter Williams. Williams, a former employee of a U.S. defense contractor, is accused of stealing eight “commercial secret zero-day exploits” between 2022 and 2025, selling them to “Operation Zero” for $1.3 million in cryptocurrency. Williams pleaded guilty in October 2025 to two counts of commercial secrets theft.

The U.S. State Department emphasized in an independent statement that the stolen tools were originally intended solely for sale to the U.S. government and its allies. Unauthorized resale poses a direct threat to U.S. intelligence capabilities. The Treasury also disclosed that “Operation Zero” is involved in developing espionage software and AI-driven tools to steal personal identification information, recruiting hackers via social media, and establishing contacts with foreign intelligence agencies.

Key Information on the Sanctions

Sanctioned Parties: Sergei Zelenyuk and Matrix LLC (“Operation Zero”), Kucherov, Vasanovich

Legal Basis: Protecting American Intellectual Property Act, marking its first application to digital trade secrets theft cases

Stolen Tools: Eight U.S. government proprietary network tools, originally intended for U.S. government and specific allies

Cryptocurrency Payments: Peter Williams sold stolen zero-day exploits for $1.3 million in cryptocurrency

Highest Bounty: “Operation Zero” previously offered a $4 million reward for a Telegram attack chain vulnerability

Frequently Asked Questions

What is the historical significance of the legal basis for these U.S. Treasury sanctions?

These sanctions are executed under the Protecting American Intellectual Property Act, which is the first time this law has been used to combat the theft and sale of digital trade secrets. OFAC states this signifies an expansion of U.S. enforcement tools against cyber tool theft into the realm of commercial secrets law, setting an important legal precedent.

What is “Operation Zero,” and how do their vulnerability trading operations work?

“Operation Zero” is a Russian exploitation broker led by Sergei Zelenyuk, purchasing security vulnerabilities for operating systems and encrypted communication apps through public bounties. Its clients are limited to Russian private and government organizations. The bounty rewards can reach up to $4 million, with transactions publicly posted on X, reflecting transparency in their dealings.

What implications does the use of cryptocurrency payments in this case have for crypto regulation?

Peter Williams paid $1.3 million in cryptocurrency to acquire stolen U.S. government zero-day exploits, highlighting cryptocurrency’s role as a primary payment method in transnational cyber espionage. This case raises regulatory concerns about the role of cryptocurrencies in national security crimes and underscores the importance of on-chain tracking tools and anti-money laundering measures in combating such transactions.