Former Trenchant CEO Admits Selling Zero-Day Exploits to Russia | Ukraine news - Межа

Peter Williams, former CEO of Trenchant, a division of defense contractor L3Harris that develops surveillance and intrusion tools for Western governments, pleaded guilty last week to stealing some of these tools and selling them to a Russian broker.

Court documents, as well as exclusive TechCrunch materials and interviews with former colleagues, explain how he managed to steal sensitive exploits from Trenchant.

Williams, a 39-year-old Australian citizen, known in the company by the nickname “Doogie,” during the investigation admitted that he stole and sold eight exploits or “zero-days” – vulnerabilities in software that are unknown to the vendor and highly valuable for breaking into devices. He noted that some of these exploits, stolen specifically from Trenchant, were valued at $35 million, but he received only $1.3 million in cryptocurrency from the Russian broker. The sales extended over several years, from 2022 through July 2025.

Thanks to his position and long tenure at Trenchant, he had a “superuser” access to an internal, secure network with multi-factor authentication, where tools for intrusions and other covert information were stored, access to which was restricted to employees with a need to know.

As a “superuser,” he could see all activity, logs, and data related to Trenchant’s network security, including exploits – this is what allowed him to gain full access to confidential information and trade secrets.

Because of this broad access, Williams used a portable external drive to transfer exploits from secure networks to Trenchant’s offices in Sydney and Washington, and then to his personal device. He later transmitted the stolen tools through encrypted channels to the Russian broker, according to the document.

A former Trenchant employee with knowledge of the company’s internal IT systems told TechCrunch that Williams “was in a very high level of trust” within the leadership. He worked at the company for years, including before the acquisitions of Azimuth and Linchpin Labs – two sister startups that merged with Trenchant.

“In my view, he was regarded as beyond reproach.”

Before the acquisition, he also worked at Linchpin Labs, previously at the Australian Signals Directorate, the country’s intelligence agency responsible for digital and electronic surveillance, according to the Risky Business podcast.

Sara Banda, a representative of L3Harris, did not respond to a request for .

In October 2024, Trenchant was warned a leak of one of its products, which was in the hands of an unauthorized software broker, according to the document. Williams led the investigation into this leak, which disputed a network breach but found that the former employee had illegally accessed from an air-gapped device.

As TechCrunch exclusive previously reported, in February 2025 Williams fired one of Trenchant’s developers for “dual employment.” Then that person learned from colleagues that Williams accused him of stealing Chrome zero-days, to which he did not have access because he worked on exploits for the iPhone and iPad. In March, Apple told the former employee that his iPhone had become the target of “spyware attacks.”

In an interview with TechCrunch, a former Trenchant developer suggested that Williams framed him to hide his own actions. It is not yet known whether this is the same employee mentioned in the court documents.

In July, the FBI questioned Williams, who told agents that the “easiest way” to steal products from a secure network was to load them onto a device with air-gap protection, such as a mobile phone or external drive. He confirmed this explanation to the FBI in August after the available evidence. He stated that his code was used by a South Korean broker after being sold to a Russian broker; however, it is not yet known how Trenchant’s codes initially ended up with the South Korean broker.

Williams used the alias “John Taylor” and other encrypted apps when interacting with the Russian broker, likely as part of Operation Zero. This Russian-language broker says it is willing to pay up to $20 million for Android and iPhone hacking tools and claims that it sells them only to Russian private and government clients.

Wired was the first to report on Williams’s possible sale of stolen Zero operation tools, since the document mentions September 2023 and the payout increasing from $200,000 to $20,000,000 in the same pattern as the Zero operation. TechCrunch did not provide on Operation Zero.

The first exploit was sold for $240,000 with a promise of further payments after confirming its operation and ongoing technical support to sustain updates. After this deal, Williams sold seven more exploits for a total of $4 million; the documents show he was to receive $4 million, but in fact received only $1.3 million.

Williams’s case has sparked significant resonance in the cybersecurity community: his possible arrest became a topic of discussion among colleagues for weeks. Industry sources say the damage was serious. “This is a betrayal of the defensive mechanism of Western national security, and a betrayal of the worst level of threat we currently face – Russia,” said a former Trenchant employee who asked to remain anonymous, adding that these secrets were passed to the enemy.