U.S. Treasury Imposes Sanctions on Russian Exploit Broker for

The U.S. Department of the Treasury has taken action against a Russian brokerage network allegedly involved in the procurement of stolen U.S. government cyber tools through cryptocurrency transactions, followed by their resale to unauthorized buyers. This action marks the inaugural enforcement of new authorities under the Protecting American Intellectual Property Act.

In a formal announcement made on Tuesday, the Treasury’s Office of Foreign Assets Control designated Sergey Sergeyevich Zelenyuk, a Russian national, along with his company, Operation Zero, and several associated individuals and firms.

This designation effectively blocks any property or interests belonging to the designated parties that fall under U.S. jurisdiction, and prohibits U.S. persons from engaging in transactions with them.

Treasury officials assert that Zelenyuk, who operates from St. Petersburg, established a business centered on acquiring and distributing “exploits”—tools that exploit software vulnerabilities for unauthorized access to systems or data extraction.

Among the exploits obtained by Operation Zero were at least eight proprietary cyber tools created by a U.S. defense contractor for exclusive use by the U.S. government and select allies.

These tools were reportedly stolen by Peter Williams, an Australian national and former employee of the contractor.

According to the Department of Justice, Williams illicitly acquired these trade secrets between 2022 and 2025, selling them to Operation Zero in exchange for millions of dollars in cryptocurrency. In October 2025, he pleaded guilty to two counts of theft of trade secrets following a thorough investigation by the Justice Department and the Federal Bureau of Investigation.

Scott Bessent: Accountability for Theft of Trade Secrets

Treasury Secretary Scott Bessent indicated that the designations are part of a broader initiative aimed at protecting sensitive American intellectual property and ensuring national security.

Bessent stated, “If you steal U.S. trade secrets, we will hold you accountable.”

The sanctions were enacted under Executive Order 13694, as amended, which targets malicious cyber-enabled activities that pose a threat to U.S. national security, foreign policy, or economic stability.

Concurrently, the State Department imposed sanctions under the Protecting American Intellectual Property Act, which enforces penalties against foreign entities engaged in significant theft of U.S. trade secrets that pose a national security or economic threat. Notably, Zelenyuk and Operation Zero represent the initial individuals sanctioned under this statute.

The Treasury further designated several associates linked to the network, including Marina Evgenyevna Vasanovich, identified as Zelenyuk’s assistant, and Special Technology Services LLC FZ, a UAE-based technology firm under Zelenyuk’s control.

Additionally, two individuals, Azizjon Makhmudovich Mamashoyev and Oleg Vyacheslavovich Kucherov, were sanctioned for providing material support, with Kucherov identified as a suspected member of the Trickbot cybercrime group—a malware operation connected to ransomware attacks targeting U.S. government agencies and healthcare providers.

Operation Zero has reportedly advertised bounties totaling millions of dollars in cryptocurrency for exploits targeting widely used U.S.-developed operating systems and encrypted messaging platforms. The Treasury noted that the firm did not disclose identified vulnerabilities to affected software companies but instead sought to sell them to clients in non-NATO countries, including foreign intelligence services.

While the Treasury acknowledged that cryptocurrency facilitated transactions for the stolen tools, it did not disclose specific crypto wallet addresses or impose blockchain-specific designations.

Source link