L3Harris: Former director jailed for selling zero-day exploits

The former head of Trenchant, a specialized cybersecurity unit of L3Harris, was sentenced Tuesday to more than seven years in prison for stealing and selling zero-day exploits to a Russian exploit broker who works with non-NATO clients, including the Russian government. The case highlights the growing danger of the trade in hacking tools and the vulnerability of critical American technologies to malicious markets.

Australian Peter Williams, 39 , served as general manager of Trenchant, the cybersecurity unit of L3Harris, which develops surveillance tools and zero-day exploits for the US government and its Five Eyes intelligence partners . These tools are considered sensitive strategic assets, with the ability to access critical infrastructure and devices around the world.

The theft of zero-day exploits

Between 2022 and 2025, Williams stole at least eight protected exploit components, which were intended exclusively for use by the U.S. government and its allies. He then sold them to the Russian broker Matrix, which operates under the name Operation Zero, promoting them as hacking tools to non-NATO buyers. This practice represents a serious violation of national security laws, and experts point out that the stolen exploits could give access to millions of devices worldwide.

See also: Former Google engineers accused of transferring trade secrets to Iran

To transport the exploits, Williams used an external portable hard drive, traversing secure networks and transferring the data to Trenchant's offices in Sydney and Washington, D.C. The tools were then sent via encrypted channels to the Russian broker, bypassing the company's standard security procedures.

L3Harris: Damages and financial consequences

Prosecutors estimate that the theft caused $35 million to L3Harris, while the sale of the exploits netted Williams about $1.3 million in cryptocurrency. On Tuesday, Judge Loren AliKhan imposed an 87-month prison sentence and ordered the forfeiture of Williams' winnings, cryptocurrency, a home and other luxury items.

See also: US targets “fraud hubs” in Southeast Asia

US Attorney for the District of Columbia, Jeanine Pirro , said : “ Williams took trade secrets that included national security software and sold them for up to $4 million in cryptocurrency. These extremely powerful tools would have allowed Russia to access millions of digital devices .” She added that Williams’ action constituted a “ national security crime ,” emphasizing that US defense capabilities are not tradable goods

The threat of zero-day exploits to security

Zero-day exploits are considered among the most valuable tools in cyberwarfare and espionage operations, as they exploit software vulnerabilities before they are known to manufacturers. Selling them to states or unregulated brokers dramatically increases the risk of eavesdropping, ransomware attacks , and infrastructure critical breaches of

Williams' case also exposes the gaps in the control and management of sensitive tools. Even experienced officials can exploit their positions of trust for personal gain, putting at risk not only corporate data but also national interests.

See also: Russian UAC-0050 targets European financial institution

Sanctions against Operation Zero

The U.S. Treasury Department confirmed Tuesday that the Russian broker has been identified as Operation Zero and announced sanctions against both the company and its owner. The move sends a clear message: the trade of high-value exploits will not go unpunished, especially when states and sensitive technology are involved.

Peter Williams’ case is a reminder to governments and companies managing critical infrastructure: the security of zero-day exploits and cyber defense tools requires rigorous controls, monitoring, and immediate accountability. The combination of human error and high-value technology can lead to catastrophic consequences, jeopardizing the security of entire networks on a global scale.

Source: www.bleepingcomputer.com