Skip to content
Briefings are running a touch slower this week while we rebuild the foundations.See roadmap
L3Harris
OrganisationUS

L3Harris

US defence contractor whose Trenchant cyber unit had at least eight government-only zero-day exploits stolen and sold to Operation Zero.

Last refreshed: 29 May 2026 · Appears in 2 active topics

Key Question

L3Harris delivers AUVs to the Navy and lost eight exploits to Russia: which is its bigger strategic story?

Timeline for L3Harris

#119 May

US prime digs into UK seabed war

Autonomous Systems: Land & Sea
#115 Apr

OFAC turns IP law on Operation Zero

Cybersecurity: Threats and Defences
View full timeline →
Common Questions
How did Peter Williams steal hacking tools from the US government?
Peter Williams worked as an executive at Trenchant, the cyber unit of US defence contractor L3Harris. He stole at least eight zero-day exploits developed exclusively for US government use and sold them to Operation Zero between 2022 and 2025.Source: DOJ sentencing documents
What is Trenchant at L3Harris?
Trenchant is L3Harris's specialist offensive cyber capability unit that develops hacking tools for classified US government programmes.Source: DOJ / OFAC
What is the L3Harris Iver4 900 autonomous underwater vehicle?
The Iver4 900 is a submarine-launched autonomous underwater vehicle manufactured by L3Harris, designed for launch and recovery through standard torpedo tubes. It entered delivery to the US Navy under a Defense Innovation Unit contract in May 2026.Source: Lowdown
What did L3Harris's Trenchant unit do and why was it in the news?
Trenchant is L3Harris's offensive cyber capability unit that develops tools for US government customers under classified programmes. It came under scrutiny after former executive Peter Williams stole at least eight zero-day exploits and sold them to the Russian-linked broker Operation Zero between 2022 and 2025.Source: US Department of Justice
How long was the L3Harris insider sentenced for selling US exploits?
Peter Williams was sentenced to 87 months (seven years, three months) on 24 February 2026 after pleading guilty on 29 October 2025 to stealing and selling at least eight classified zero-day exploits.Source: US Department of Justice
What is OFAC's link to the L3Harris cyber case?
OFAC used the Protecting American Intellectual Property Act for the first time in a cyber matter, sanctioning Sergey Zelenyuk and his firm Operation Zero — the Russian-linked broker that bought the exploits stolen from L3Harris's Trenchant unit — simultaneously with the DOJ sentencing of Williams.Source: OFAC / US Treasury
What is L3Harris's role in Royal Navy autonomous underwater vehicles?
L3Harris is active in torpedo-tube-launched AUV supply to allied navies. It announced in May 2026 that its Iver4 900 AUV is in delivery to the US Navy, competing in the same sector where HII's REMUS programme is courting the Royal Navy through British partner Babcock.Source: Lowdown

Background

L3Harris Technologies is a US defence and aerospace company whose Trenchant cyber unit developed zero-day exploits exclusively for US government use. Former Trenchant executive Peter Williams stole at least eight of those exploits and sold them to Operation Zero between 2022 and 2025. Williams pleaded guilty on 29 October 2025 and was sentenced to 87 months on 24 February 2026.

L3Harris is one of the largest US defence contractors, operating across electronic warfare, space, communications, and cyber domains. The company is also a significant maritime autonomy supplier: on 27 May 2026 it announced that its submarine-launched Iver4 900 autonomous underwater vehicle is in delivery to the US Navy under a Defense Innovation Unit contract. The Iver4 900 is designed for launch and recovery through standard torpedo tubes, placing L3Harris alongside HII's REMUS programme in the emerging market for torpedo-tube-compatible AUVs serving allied navies.

For the defence industrial base, the Williams case prompted reviews of technical controls on classified cyber-tool repositories. The combination of OFAC's simultaneous sanctioning of the buyer network and DOJ sentencing of the insider creates a two-end enforcement signal across both the supply and demand sides of the exploit-theft pipeline.

Source Material