The U.S. Treasury Department has sanctioned Russian exploit broker Matrix LLC (Operation Zero) and its owner Sergey Zelenyuk for purchasing stolen zero-day exploits developed exclusively for the U.S. government. At the same time, a federal court sentenced a former L3Harris executive to 87 months in prison for selling eight stolen cyber tools for approximately $1.3 million in cryptocurrency.
The Office of Foreign Assets Control (OFAC) designated Matrix LLC under the Protecting American Intellectual Property Act (PAIPA) — marking the first use of the law since its enactment.
Sanctions also target:
Sergey Sergeyevich Zelenyuk;
five associated individuals and entities;
UAE-based front company Special Technology Services LLC;
Advance Security Solutions operating in the UAE and Uzbekistan;
individuals with alleged ties to the Trickbot cybercrime group.
The sanctions freeze U.S.-held assets and expose any entities dealing with the sanctioned parties to secondary penalties.
According to the Treasury Department, Operation Zero purchased proprietary zero-day exploits intended solely for U.S. government and allied intelligence use, later reselling them to unauthorized clients.
The Department stated:
“Zelenyuk and Operation Zero trade in ‘exploits’—pieces of code or techniques that take advantage of vulnerabilities in a computer program to allow users to gain unauthorized access, steal information, or take control of an electronic device—and have offered rewards to anyone who will provide them with exploits for U.S.-built software.”
Peter Williams, 39, an Australian national and former general manager of Trenchant (L3Harris’ cybersecurity unit), stole at least eight protected exploit components between 2022 and 2025.
He transferred the tools from secure networks in Sydney and Washington, D.C., using portable storage devices and sent them to the Russian broker via encrypted channels. Prosecutors estimate $35 million in losses to L3Harris. The stolen exploits could have enabled access to millions of digital devices worldwide.
Williams pleaded guilty and was sentenced to 87 months in prison, forfeiting $1.3 million in cryptocurrency, real estate, and luxury assets. U.S. Attorney Jeanine Pirro stated:
“By betraying a position of trust and selling sensitive American technology, Williams’ crime is not only one of theft, it is a crime of national security. Our nation’s defense capabilities are not commodities to be auctioned off.”
The Operation Zero case marks a significant escalation in U.S. efforts to combat international zero-day trafficking. With the first-ever use of PAIPA sanctions and a lengthy prison sentence for an insider threat, Washington signals that exploit brokering tied to national security assets will be treated as a strategic threat. The zero-day market is no longer just a cybersecurity issue — it is firmly embedded in geopolitical confrontation.
