Operation Zero
Operation Zero is a Russia-based exploit broker, publicly operating through Matrix LLC and run by Russian national Sergey Sergeyevich Zelenyuk from St. Petersburg since 2021. It has been described as a zero-day broker that acquires and distributes cyber tools and offers multimillion-dollar bounties for exploits targeting widely used software, including U.S.-built operating systems, encrypted messaging applications such as Telegram, and mobile device compromise. The content states that Operation Zero does not disclose vulnerabilities to affected vendors and publicly claims to sell only to non-NATO customers, including the Russian government. U.S. authorities also stated that it sought to sell exploits to foreign intelligence agencies, recruited hackers through social media, and pursued development of spyware and methods to extract personal identifying information and other sensitive data uploaded to AI/LLM applications. Operation Zero was sanctioned by the U.S. Treasury and designated by the U.S. State Department in February 2026. The content identifies Matrix LLC as doing business as Operation Zero, and also names UAE-based Special Technology Services LLC FZ (STS) as a Zelenyuk-controlled affiliate established to expand operations in Asia and the Middle East and likely bypass sanctions. Associated sanctioned individuals and entities mentioned in the content include Marina Evgenyevna Vasanovich, Azizjon Makhmudovich Mamashoyev, Oleg Vyacheslavovich Kucherov, and Advance Security Solutions. The content states that Operation Zero acquired at least eight proprietary cyber tools stolen from a U.S. company and sold them to at least one unauthorized user. These tools were stolen between 2022 and 2025 by former L3Harris/Trenchant employee Peter Williams and sold to Operation Zero for cryptocurrency. Reporting in the content also says Operation Zero may have acquired the Coruna iOS exploit kit and sold it to other threat actors, including financially motivated cybercriminals. Known aliases and related names directly mentioned in the content are Matrix LLC and Operation Zero.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Where they're from
Attributed origin per open-source reporting.
- RU
Tradecraft
15 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Recent activity
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Russian exploit broker suspected of acquiring the Coruna exploit kit and selling it to other threat actors, including cybercriminals.
Exploit broker network involved in theft and sale/trafficking of cyber exploits and stolen government cyber tools to overseas buyers.
Russia-based exploit brokerage that buys and sells zero-day exploits (including for widely used operating systems and encrypted messaging apps) and advertises sales to non-NATO customers; per the cited U.S. Treasury language, it has sought relationships with foreign intelligence agencies, recruited hackers via social media, and explored development of spyware and data-extraction capabilities. The content links Operation Zero to downstream use of exploits for ransomware and other malicious activity by customers.
Russian exploit brokerage operation acquiring and distributing high-value zero-day exploits (e.g., for Telegram, Android, iPhone) and seeking to sell them to non-NATO customers, including foreign intelligence agencies; also described as pursuing development of spyware and data-extraction capabilities.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.