US Treasury Sanctions Russian National for Allegedly Trading Stolen US Cybertools

The White House and the U.S. Department of the Treasury in Washington on March 10, 2025. Madalina Vasiliu/The Epoch TimesThe Treasury and the State Department imposed sanctions on a Russian national and his firm for allegedly acquiring and selling stolen cybertools originally developed for the U.S. government, officials announced on Feb. 24.The Office of Foreign Assets Control (OFAC) sanctioned Sergey Sergeyevich Zelenyuk and Matrix LLC, doing business as Operation Zero, and five related individuals and entities. The firm traded in stolen information and technology that has the potential to undermine national security, according to a Treasury Department statement.“If you steal U.S. trade secrets, we will hold you accountable,” Treasury Secretary Scott Bessent said in a statement. “Treasury will continue to work alongside the rest of the Trump Administration to protect sensitive American intellectual property and safeguard our national security.”Treasury officials allege that Operation Zero acquired at least eight specialized cybertools—designed for the U.S. government and select allies—that were stolen from a U.S. company.The firm then sent the tools to at least one black market buyer, who could use the technology for ransomware attacks, espionage, and other harmful activities. Operation Zero restricted sales to non-NATO nations. It also pursued partnerships with foreign intelligence services on social media. The company also allegedly considered developing its own spyware and techniques to skim data from artificial intelligence platforms.The Treasury Department also designated Oleg Vyacheslavovich Kucherov, whom it suspects of involvement with the Trickbot cybercrime group, which was previously sanctioned by OFAC in 2023 because of malware enabling ransomware deployed against U.S. entities, such as government and health care facilities.The sanctions use a new tool at the disposal of the Treasury: executive orders 13694 and 14306, which specifically address malicious cyberoperations against the United States.Simultaneously, the Department of State sanctioned Zelenyuk, Operation Zero, and an affiliated United Arab Emirates company, Special Technology Services LLC FZ, under the Protecting American Intellectual Property Act.The case is unfolding as the Justice Department and FBI investigate Peter Williams, an Australian former employee of the U.S. company from whom the tools were stolen.Williams pleaded guilty on Oct. 29, 2025, to two counts of trade secret theft. He admitted to stealing tools over three years and selling them to Operation Zero. He earned millions in cryptocurrency.“America’s national security is NOT FOR SALE, especially in an evolving threat landscape where cybercrime poses a serious danger to our citizens,” Attorney General Pam Bondi said at the time.The sanctions dictate that transactions involving all U.S.-held property of the sanctioned parties are blocked. Entities owned 50 percent or more by sanctioned individuals face similar restrictions.U.S. citizens are also blocked from transactions involving these assets, and violations risk civil or criminal penalties. OFAC notes that sanctions are designed to encourage behavioral change. Individuals and firms placed on the sanctions list may be removed from the list if they comply with specified requirements.