Treasury targets Russian exploit broker network over stolen U.S. government cyber tools
The U.S. Treasury sanctioned a Russian exploit broker, his company and five affiliates over the acquisition and sale of stolen cyber tools developed for exclusive use by the U.S. government and allies.
WASHINGTON, February 24, 2026 — The U.S. Treasury Department said Tuesday that the Office of Foreign Assets Control sanctioned Sergey Sergeyevich Zelenyuk, his St. Petersburg-based company Matrix LLC, which does business as Operation Zero, and five associated individuals and entities for trafficking in cyber tools harmful to U.S. national security. Treasury said the network acquired at least eight proprietary cyber tools that had been stolen from a U.S. company and were created for the exclusive use of the U.S. government and select allies.
Treasury said Operation Zero has operated as an exploit broker since 2021, offering millions of dollars in bounties for exploits targeting widely used software, including U.S.-built operating systems and encrypted messaging applications. The department said the company did not disclose the vulnerabilities to affected software developers and instead sought customers in non-NATO countries, including foreign intelligence agencies.
OFAC designated Zelenyuk and Operation Zero under Executive Order 13694, as further amended, the cyber-related sanctions authority. Treasury said the State Department, in parallel, sanctioned Zelenyuk, Operation Zero and UAE-based Special Technology Services LLC FZ under the Protecting American Intellectual Property Act, marking the first sanctions imposed under that law.
Treasury also designated Marina Evgenyevna Vasanovich, described as Zelenyuk’s assistant, Special Technology Services LLC FZ, Azizjon Makhmudovich Mamashoyev, suspected Trickbot member Oleg Vyacheslavovich Kucherov, and Advance Security Solutions, an exploit brokerage firm with operations in the United Arab Emirates and Uzbekistan. Treasury linked Mamashoyev and Kucherov to prior work relationships with Operation Zero and said Advance Security Solutions was created by Mamashoyev.
The action highlights growing U.S. willingness to use sanctions, not only criminal cases and export controls, against commercial brokers that buy and resell offensive cyber capabilities. As with other OFAC designations, U.S.-linked property and interests in property of the blocked persons are frozen, and U.S. persons are generally prohibited from dealing with them.
Regulatory Actions
Structured data extracted from official sources and validated by sanctions experts