Coindesk

U.S. Sanctions Target Russian Zero-Day Exploit Brokers

First seen 24 Feb 2026, 21:09 UTC • Techcrunch

+20 •32.7

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

The U.S. Treasury announced sanctions against two companies and their founders involved in acquiring and reselling zero-day exploits, which are vulnerabilities in software that can be exploited by hackers. An Australian national was implicated in selling cyber tools to a Russian company, Operation Zero, which poses risks to U.S. national security and economic interests.

How this analysis works

Timeline

2026-02-24

U.S. Treasury announces sanctions against exploit brokers

2026-02-24

Australian national accused of selling cyber tools to Operation Zero

Attack Flow

16 entities, 23 inferred relationships (STIX 2.1).

Technique (4)

Data Breach
Malware
Ransomware
Zero-day Exploit

Campaign (1)

Operation Zero

Organization (5)

Advance Security Solutions
Matrix LLC
Special Technology Services
The US Treasury
X

Malware (1)

Trickbot

Affected Platform (4)

Android
IOS
Telegram
Windows

Tool (1)

Chrome

Relationships

Operation Zero uses Trickbot
Trickbot targets Advance Security Solutions
Trickbot targets Matrix LLC
Trickbot targets Special Technology Services
Trickbot targets The US Treasury
Data Breach targets Android
Data Breach targets IOS
Data Breach targets Telegram
Data Breach targets Windows
Malware targets Android
Malware targets IOS
Malware targets Telegram
Malware targets Windows
Ransomware targets Android
Ransomware targets IOS
Ransomware targets Telegram
Ransomware targets Windows
Zero-day Exploit targets Android
Zero-day Exploit targets IOS
Zero-day Exploit targets Telegram
Zero-day Exploit targets Windows
Operation Zero related to X
Operation Zero related to Chrome

Continue Reading

Operation Endgame Disrupts Evil Corp's SocGholish Malware Network EU Sanctions Russia Over Ongoing Cyber Espionage Campaign MuddyWater Targets U.S. Entities Amid Geopolitical Tensions EU Sanctions Vitaly Kovalev, Ransomware Leader of Trickbot Group FishMonger Expands SprySOCKS Malware to Windows with Kernel-Level Stealth Widespread Abuse of ScreenConnect to Deploy AsyncRAT via Fake Installers

U.S. Sanctions Target Russian Zero-Day Exploit Brokers

Article Content

Timeline

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading