Loading story…
Nathan Vilas Laatsch, a former civilian IT specialist assigned to the Defense Intelligence Agency's security and Insider Threat Division, pleaded guilty to attempting to provide classified U.S. intelligence to a person he believed represented a friendly foreign government. Holding a Top Secret clearance, Laatsch manually copied classified material from DIA systems, concealed notes while leaving secure facilities, and created files for transfer; he reportedly sought citizenship from the foreign nation and cited opposition to the administration.
In an FBI undercover operation, Laatsch left a USB drive in an Arlington, Virginia, park for an undercover agent, then attempted a second transfer on May 29, 2025, when he was arrested. The recovered device held nine documents, including eight marked Top Secret/Sensitive Compartmented Information, covering intelligence-collection methods, foreign military exercises, and related analysis. Laatsch admitted the conduct and agreed to a recommended prison term of 11 to 18 years; the court could impose life imprisonment and a $250,000 fine.
See attribution, scope, and your downstream exposure.
6 events from the most recent confirmed update back to the earliest known activity.
On August 27, 2026, Laatsch pleaded guilty to attempting to transmit classified U.S. information to a foreign government. His plea agreement recommended an 11-to-18-year sentence, while the court could impose up to life imprisonment and a $250,000 fine.
On May 29, 2025, Laatsch electronically transferred files from his personal computer at an Arlington park picnic table as part of a second FBI-arranged dead drop. FBI agents arrested him after the transfer attempt; he later admitted the offenses during questioning.
Between May 15 and May 27, 2025, Laatsch again copied classified information by hand at DIA and smuggled the notes from the facility, including by concealing them in his socks.
On May 1, 2025, Laatsch placed a thumb drive at a dead-drop location in an Arlington, Virginia park for a person he believed represented the foreign government. The FBI recovered the device, which contained nine documents, including eight marked Top Secret/Sensitive Compartmented Information.
From April 28 through April 30, 2025, Laatsch accessed classified information at work and transcribed it by hand into a notebook. He concealed the handwritten pages in his socks and, on one occasion, in his lunchbox when leaving the DIA office.
In March 2025, DIA IT specialist Nathan Vilas Laatsch used a newly created email account to offer classified intelligence products and documentation to an overseas government described as friendly. The FBI learned of the offer and began an undercover operation using an agent posing as a foreign intelligence contact.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
5 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcedatabreaches.net
Open sourcescworld.com
Open sourcetheregister.com
Open sourcenextgov.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Peter Williams, a former executive at L3Harris subsidiary Trenchant, pleaded guilty in U.S. federal court to two counts of theft of trade secrets after admitting to selling at least eight sensitive cyber-exploit components, including zero-day vulnerabilities, to a Russian software broker. The stolen materials, intended exclusively for the U.S. government and its allies, were sold over a three-year period from 2022 to 2025 in exchange for millions of dollars in cryptocurrency. U.S. prosecutors stated that Williams signed multiple contracts with the Russian broker, which publicly advertises itself as a reseller of cyber exploits to clients including the Russian government, and that the offenses cost L3Harris $35 million in damages. Williams, who previously worked for the Australian Signals Directorate, used encrypted communications to facilitate the transactions and used the proceeds to purchase luxury items. The Russian broker, identified in court as "Company 3" and believed to be Operation Zero, is known for seeking mobile exploits for non-NATO clients. Williams faces a potential prison sentence of 87 to 108 months, fines up to $300,000, and restitution of $1.3 million, and is currently under house arrest pending sentencing. Authorities highlighted the national security risks posed by the sale of these sophisticated cyber tools to foreign actors outside the U.S. and its allies.
Jun 29, 2026
Federal prosecutors have charged Peter Williams, a former executive at L3Harris Technologies’ cyber division, with stealing eight trade secrets from two unnamed companies and selling them to a Russian buyer for over $1.3 million. Williams, an Australian national who led Trenchant—a division specializing in hacking and surveillance tools for Western intelligence agencies—allegedly misappropriated confidential proprietary data between 2022 and 2025. Authorities are seeking to seize assets tied to the illicit profits, including real estate, luxury items, and funds in multiple bank and cryptocurrency accounts. The Department of Justice has not accused L3Harris or Trenchant of any wrongdoing, and the nature of the stolen trade secrets remains undisclosed. Court documents indicate that Williams systematically transferred sensitive information over a period of more than three years, with the case surfacing after an internal investigation at Trenchant reportedly triggered by a leak of hacking tools. While Williams was reportedly arrested, federal officials later clarified he is not in federal custody. The Russian recipient of the stolen data has not been identified, and L3Harris has not commented on the case. An arraignment and possible plea agreement are scheduled in Washington, D.C., as authorities continue to investigate the extent of the breach and its implications for national security.
Jul 12, 2026
U.S. prosecutors said **Peter Williams**, a former executive at *Trenchant* (a hacking and surveillance tools unit of U.S. defense contractor **L3Harris**), stole and sold **eight hacking tools/exploits** to a **Russian company** that counts the Russian government among its customers. The Department of Justice said the sales **directly harmed the U.S. intelligence community** and that the tools could have been used to enable **indiscriminate government surveillance**, **cybercrime**, and **ransomware** at global scale, potentially affecting **millions of computers and devices**, including in the United States. Williams, an Australian national, pleaded guilty in October to trade secret theft tied to the sales, which prosecutors said generated **more than $1.3 million in cryptocurrency** between 2022 and 2025. Ahead of his expected Feb. 24 sentencing in Washington, D.C., prosecutors filed a sentencing memorandum seeking **nine years in prison**, **three years of supervised release**, **$35 million in restitution**, and a **$250,000 fine**; the filing also indicates Williams is expected to be **deported to Australia** after serving his sentence, and notes he submitted a letter expressing regret.
Jun 29, 2026