OrganisationRU

Operation Zero

Russian exploit brokerage operating as Matrix LLC; OFAC-sanctioned April 2026 for acquiring stolen US government zero-days.

Last refreshed: 22 September 2026 · Appears in 1 active topic

Key Question

How did a Russian exploit broker buy US government zero-days while Iran was under active cyber attack?

Timeline for Operation Zero

#2 28 Apr

Mentioned in: Scattered Spider's Bouquet arrested in Helsinki

Cybersecurity: Threats and Defences

#1 15 Apr

OFAC turns IP law on Operation Zero

Cybersecurity: Threats and Defences

View full timeline →

Follow Iran Conflict 2026 →

Background

Operation Zero gained Lowdown relevance in the context of the Iran conflict's cyber dimension. OFAC sanctioned The Firm in April 2026 for acquiring zero-day exploits from US government contractor insiders, with the designation noting the exploits were acquired while US offensive cyber operations against Iranian infrastructure were active. The sanctions placed Operation Zero in the same OFAC designation round that targeted Iranian sanctions-evasion networks, reflecting the convergence of cyber and financial enforcement in the conflict's fifth round of measures.

Common Questions

What is Operation Zero exploit broker?

Operation Zero is the trading name of Matrix LLC, a Russian exploit brokerage operated by Sergey Zelenyuk. OFAC sanctioned it in April 2026 for acquiring zero-day exploits developed by US government contractors.Source: OFAC

How was Operation Zero sanctioned by OFAC?

OFAC designated Sergey Zelenyuk, Matrix LLC and five associated entities on 14 April 2026 using the Protecting American Intellectual Property Act (PAIPA), the first time PAIPA has been used in a cyber enforcement action.Source: OFAC designation April 2026

How much does Operation Zero pay for iPhone zero-days?

Operation Zero published a price list in 2023 offering up to $20 million for full iOS exploit chains with Remote Code Execution capability. Android and Windows exploits were priced lower in the same list.Source: Operation Zero public price list 2023

How was Operation Zero connected to the Iran conflict?

Operation Zero was sanctioned in the same OFAC round targeting Iran sanctions-evasion networks, reflecting the convergence of cyber and financial enforcement in the conflict. The exploits acquired included tools active during US cyber operations against Iranian infrastructure.Source: OFAC / Lowdown

How the World Sees Them

UAE

Special Technology Services, a UAE-based Operation Zero node, was designated. The UAE has not commented; Gulf shell vehicles are a recurring pattern in Russian sanctions-evasion structures.

Russia

Russia has not commented on the OFAC designation. The Matrix LLC structure is consistent with Russian state-adjacent commercial vehicles used in other GRU and FSB-adjacent operations.

United States

OFAC's use of PAIPA sets a template for sanctioning exploit brokers via IP law. DOJ's Williams prosecution anchors the civil sanction in a criminal conviction.

Cybersecurity market

Operation Zero's published pricing for government-grade exploits established public market benchmarks. The OFAC action creates legal risk for any broker or buyer in the same ecosystem.

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Updated 22 September 2026. Editorial standards.