Matrix LLC
Russian LLC operated by Sergey Zelenyuk as the corporate vehicle for Operation Zero exploit brokerage, sanctioned by OFAC in April 2026.
Last refreshed: 17 April 2026 · Appears in 1 active topic
How did Operation Zero use a UAE shell company to avoid OFAC scrutiny?
Timeline for Matrix LLC
OFAC turns IP law on Operation Zero
Cybersecurity: Threats and Defences- What is Operation Zero and why was it sanctioned?
- Operation Zero is a Russian zero-day exploit brokerage run via Matrix LLC by Sergey Zelenyuk. OFAC sanctioned it in April 2026 under the PAIPA for acquiring and reselling US government cyber tools stolen by former L3Harris executive Peter Williams.Source: OFAC designation
- How did Operation Zero avoid being shut down earlier?
- Operation Zero operated through a Russian LLC (Matrix LLC) alongside a UAE shell company (Special Technology Services) to distance sanctioned Russian entities from its transactions. The structure allowed it to operate semi-publicly as a commercial broker.Source: OFAC designation
Background
Matrix LLC is the Russian-registered limited liability company through which Sergey Zelenyuk operated Operation Zero, an exploit brokerage that acquired zero-day exploits developed by former L3Harris Trenchant executive Peter Williams exclusively for US government use. OFAC designated Matrix LLC in April 2026 under the Protecting American Intellectual Property Act (PAIPA) alongside Zelenyuk, Marina Vasanovich, Special Technology Services (UAE), Azizjon Mamashoyev and Oleg Kucherov.
Operation Zero operated as a public-facing zero-day acquisition and resale platform, advertising prices of up to $2.5m for full-chain iOS exploits. The corporate structure used Matrix LLC in Russia alongside a UAE-based shell company (Special Technology Services) to route transactions and distance sanctioned Russian entities from the paperwork. OFAC's designation explicitly names this routing as part of the violation.
The PAIPA action is the first use of the legislation in a cyber matter, and Matrix LLC is the primary designated corporate vehicle. For exploit brokers operating in or through jurisdictions with Gulf financial infrastructure, the designation signals that Treasury is willing to follow the corporate structure to its shell-company layer.