Operation Zero
Russian exploit-acquisition firm publicly sanctioned by the U.S. Treasury OFAC in February 2026, alongside its founder Sergey Zelenyuk, for operating a market in zero-day vulnerabilities and exploit kits. Treasury's designation named Operation Zero as the buyer of eight proprietary U.S. Government cyber tools stolen by an American insider (Williams), who pleaded guilty in October 2025 and was sentenced February 2026 to 87 months. Operation Zero is publicly known as the highest-paying exploit acquisition programme in the post-2022 market — bounty offers of $20M for Android / iOS chains. The OFAC action is the first U.S. government sanctioning of a commercial exploit broker, and signals a category extension of cyber-sanctions to the offensive-tooling supply chain rather than only the operator end.
Aliases
Motivations
Target sectors
Target countries
Diamond Model
Caltagirone / Pendergast / Betz 2013 — four-vertex attribution framework.
MITRE ATT&CK techniques
Timeline
1 eventIndicators of compromise
0 indicatorsRelated actors
shared ATT&CK techniquesReferences
cite this page
Threat Intel Tracker. (2026-05-19). Operation Zero — actor profile. Retrieved from https://threatintel.local/actors/operation-zero