<p>The Treasury Department on Tuesday sanctioned Russian firm Operation Zero and several affiliated individuals for allegedly buying stolen cyber tools originally developed for the U.S. government and reselling them for millions in cryptocurrency.</p>
Introduction to Malware Binary Triage (IMBT) Course
Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.
Enroll Now and Save 10%: Coupon Code MWNEWS10
Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.
<p>Treasury also <a href=“Treasury Sanctions Exploit Broker Network for Theft and Sale of U.S. Government Cyber Tools | U.S. Department of the Treasury”>sanctioned</a> the company’s leader, Sergey Sergeyevich Zelenyuk, for the firm’s role in allegedly acquiring the eight proprietary cybersecurity tools built by a U.S. company that were meant for use by the federal government and select allies. The company resold the stolen tools to “at least one unauthorized user,” Treasury said.</p>
<p>Operation Zero trades in cyber exploits, which include various software toolkits containing specialized code built to steal data and compromise computer systems.</p>
<p>The sanctions against the firm and Zelenyuk run parallel with an FBI investigation into Peter Williams, a former employee of Trenchant, which is owned by defense contractor L3Harris. Williams <a href=“Office of Public Affairs | Former General Manager for U.S. Defense Contractor Pleads Guilty to Selling Stolen Trade Secrets to Russian Broker | United States Department of Justice”>pleaded guilty</a> in October to selling at least eight of the company’s exploits to a Russian broker whose identity was not disclosed at the time. </p>
<p>Treasury appears to now have identified that broker as Operation Zero. Williams “stole several proprietary cyber tools from the company between 2022 and 2025 and sold them to Operation Zero in exchange for millions of dollars paid in cryptocurrencies,” the department said in a statement announcing the sanctions.</p>
<p>Zelenyuk did not immediately respond to a request for comment.</p>
<p>The U.S. also sanctioned a United Arab Emirates–based affiliate, Special Technology Services, along with Zelenyuk’s assistant, Marina Evgenyevna Vasanovich. The department additionally designated two individuals tied to the company — Azizjon Makhmudovich Mamashoyev and Oleg Vyacheslavovich Kucherov — who allegedly worked with Operation Zero.</p>
<p>Kucherov, a Russian national, is notably suspected of being affiliated with the ransomware group Trickbot, whose alleged members have previously been <a href=“US and UK Join Forces to Sanction Russian Hackers - Nextgov/FCW”>sanctioned</a> by both the United States and the United Kingdom.</p>
<p>The actions are the first to be invoked under a <a href=“[2023-01-05] President Biden Signs Van Hollen Legislation to Curb IP...”>2023 law</a> mandating financial penalties against parties that pilfer U.S. trade secrets.</p>
<p>“If you steal U.S. trade secrets, we will hold you accountable,” Secretary of the Treasury Scott Bessent said in a statement. “Treasury will continue to work alongside the rest of the Trump administration to protect sensitive American intellectual property and safeguard our national security.”</p>
<p>Stealing U.S.-built cyber exploits can grant foreign adversaries and criminal groups ready-made hacking tools they can quickly turn against government networks, defense contractors and critical infrastructure.</p>
Article Link: Treasury sanctions Russian firm said to have stolen and sold US cyber tools - Nextgov/FCW