A former general manager of L3Harris’ offensive cyber division Trenchant has been sentenced to seven years in prison for stealing and selling proprietary hacking tools to a Russian intermediary, in a case that has jolted the tightly controlled market for government-grade exploits.
Prosecutors said Peter Williams, 39, an Australian citizen living in Washington, D.C., pleaded guilty to taking seven Trenchant trade secrets and selling them for cryptocurrency. U.S. officials identified the buyer as Operation Zero, a Russia-based vulnerability broker. The Justice Department said the tools could have enabled remote access to potentially millions of devices, while the Treasury Department announced sanctions on the broker.
A Rare Insider Theft In The Cyber Arms Trade
Trenchant builds so-called zero-day capabilities—previously unknown software flaws and the exploits that weaponize them—for use by the U.S. government and a small circle of close allies in the Five Eyes intelligence alliance: Australia, Canada, New Zealand, the United Kingdom, and the United States. Williams ran the unit before his departure from the company, and previously worked for an Australian intelligence agency and the country’s military, according to court filings.
Investigators said Williams sold seven confidential tools and related know-how to Operation Zero between 2022 and 2025, receiving roughly $1.3 million in crypto. The case is notable not just for the theft of crown-jewel trade secrets, but also for the downstream risk: once advanced intrusion tooling exits controlled channels, containment becomes nearly impossible.
Operation Zero Named And Sanctioned By Treasury
The Treasury Department publicly named Operation Zero as the broker at the center of the scheme and imposed sanctions, a move that effectively bars U.S. persons from doing business with the firm and aims to cut it off from the dollar-based financial system. Sanctions also serve as a warning shot to adjacent actors in the exploit marketplace who facilitate deals with state buyers.
Operation Zero advertises multimillion-dollar payouts for vulnerabilities affecting Android and iPhone, as well as popular encrypted messaging apps such as Telegram. The company claims it resells exclusively to Russian government entities and domestic companies—an assertion that, if accurate, underscores why U.S. authorities treated the case as a national security matter and not merely corporate espionage.
High Stakes For Five Eyes Cyber Capabilities
Tools produced by units like Trenchant are typically developed under strict legal, policy, and export-control constraints. Their value lies not only in technical novelty, but also in secrecy and control. When those capabilities are stolen, adversaries can repurpose them, harden their own systems, or tip off third parties, degrading the original owners’ operational advantage.
Prosecutors said the stolen exploits could be used to break into a vast number of devices. Mobile platforms are a particular prize, as they combine always-on connectivity, rich sensors, and ubiquitous use by officials, journalists, and business leaders. That mix makes zero-click or one-click chains especially potent, and potentially geopolitically consequential.
Inside The Zero-Day Market By The Numbers
The opaque but lucrative zero-day economy has matured into a professionalized marketplace where brokers compete on price and exclusivity. Firms such as Zerodium and Crowdfense have publicly posted seven-figure bounties for high-impact mobile exploit chains. Google’s Project Zero recorded 58 zero-days exploited in the wild in 2021, 41 in 2022, and 61 in 2023—figures that reflect both fluctuating attacker activity and improved detection by defenders.
Research groups including Citizen Lab and Amnesty International have documented repeated misuse of commercial intrusion tools against civil society, amplifying scrutiny of vendors, brokers, and end customers. That scrutiny complicates life for legitimate government buyers while raising the stakes for insiders who might be tempted to divert proprietary tooling to the highest bidder.
What To Watch Next As Agencies And Firms Respond
The sentencing will likely trigger deeper audits across the defense and security sector, from access control and code repository monitoring to data loss prevention around exploit development environments. Companies will also revisit employee vetting and offboarding protocols, where insider risk often peaks.
On the policy front, sanctions enforcement and information-sharing between Treasury, Justice, and allied governments will shape how aggressively the U.S. disrupts exploit brokers serving hostile states. The case sends a clear signal: the legal and financial costs of trafficking in stolen cyber capabilities are rising, even as demand—and payouts—remain high.
