Connect with us

Tech

Treasury sanctions Russian zero-day broker accused of buying exploits stolen from US defense contractor

The U.S. government announced on Tuesday sanctions against two companies that acquire and resell zero-day exploits, as well as sanctioning their founders and their associates.

Officials with the U.S. Treasury told TechCrunch that the government was imposing sanctions against the brokers of zero-days — security vulnerabilities in software that are unknown to its developer but can be abused to hack people — as they pose a threat to U.S. national security, foreign policy, and economy. 

The first sanctioned company is Operation Zero, a Russian firm that launched in 2021. The company made headlines in 2023 when it announced that it was offering up to $20 million for zero-days in Android devices and iPhones, and later announced that it was offering up to $4 million for zero-days in Telegram. The company claims to work exclusively with the Russian government and local organizations.

The Treasury’s Office of Foreign Assets Control (OFAC) said that Operation Zero’s customers “could use the tools to launch ransomware attacks or engage in other malign activities.”

The Treasury said it’s also sanctioning the company’s founder, Sergey Zelenyuk, who officials accused of selling exploits to foreign intelligence agencies and who say he sought to develop spyware and hacking technologies. The Treasury said Zelenyuk engaged in recruiting hackers and developing relationships with foreign intelligence agencies through social media. (Operation Zero has accounts on both X and Telegram.)

According to the Treasury, Operation Zero acquired “at least eight proprietary cyber tools, which were created for the exclusive use of the U.S. government and select allies and which were stolen from a U.S. company,” and then “sold those stolen tools to at least one unauthorized user.” 

The Treasury said that the sanctions against Operation Zero and Zelenyuk coincide with an FBI investigation into Peter Williams, who worked for U.S. defense contractor L3Harris. In October, Williams pleaded guilty to selling at least eight of the company’s exploits to an unspecified Russian broker. 

The Treasury now says that the broker was Operation Zero, something that the government had not previously confirmed.

Contact Us

Do you have more information about Operation Zero? Or the market for zero-days? We’d love to hear from you. From a non-work device, you can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram, Keybase and Wire @lorenzofb, or by email.

Williams was the general manager at Trenchant, which develops hacking and surveillance tools for the U.S. government and some of its top intelligence partners, including Australia, Canada, New Zealand, and the United Kingdom — the so-called alliance of Five Eyes countries. 

The Treasury did not respond to a series of questions related to today’s sanctions. 

Along with taking action against Zelenyuk, the U.S. Treasury is sanctioning an affiliate company based in the United Arab Emirates called Special Technology Services, as well as Zelenyuk’s assistant, Marina Evgenyevna Vasanovich, and two people associated with the company, Azizjon Makhmudovich Mamashoyev and Oleg Vyacheslavovich Kucherov, who have allegedly worked with Operation Zero. 

Operation Zero, Special Technology Services, and Zelenyuk are being sanctioned in parallel under a 2022 federal law that allows the U.S. government to impose sanctions on someone who committed “significant thefts of trade secrets,” per the Treasury.

The Treasury says Kucherov, a Russian national, is suspected of being a member of the prolific ransomware gang TrickBot, whose alleged members were previously sanctioned by the U.S. and the United Kingdom. 

Mamashoyev is allegedly the founder of Advance Security Solutions, another zero-day broker based in the UAE, which was also sanctioned today.

Advance Security Solutions launched last year, offering up to $20 million for zero-days that could help hack into any type of smartphone with a text message. The broker also offered high-paying bounties for hacking tools in popular software and hardware like Android devices, iPhones, Windows, and Chrome. 

Operation Zero and Zelenyuk did not respond to a request for comment. Kucherov, Mamashoyev, and Vasanovich could not be immediately reached for comment. 

When contacted by TechCrunch, a person operating an Advance Security Solutions’ chat account claimed without evidence that Mamashoyev is not the founder of the company.

source

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Tech

Founder of Shark Tank-backed startup Scholly sues his acquirer Sallie Mae

When Chris Gray sold his Shark Tank-backed scholarship search startup Scholly to Sallie Mae in 2023, he thought he had it all. Now he’s suing the student loan giant for wrongful termination and alleging that it’s selling the data his app collected, which includes personal info on minors, without properly informing users. 

Gray co-founded the company a decade prior with the hope of helping students more easily find college scholarships that were going untapped. Within two years, he nabbed sharks Daymond John and Lori Greiner as investors after an appearance on the show

With the acquisition, Gray became one of the few Black venture-backed fintech founders to exit their company, despite receiving some blowback that he was “selling out.” “I think being one of the first Black tech companies to get acquired by a bank, that’s really a big achievement,” he said at the time. 

He took a vice president role at Sallie Mae and expected to settle in nicely at his new gig, while helping scale Scholly and making it free to use, he said in an exclusive interview with TechCrunch.

What happened next is detailed in Gray’s lawsuit against Sallie Mae in Delaware Superior Court, and in a whistleblower complaint he submitted to the Securities and Exchange Commission, both of which he filed earlier this month. 

He alleges Sallie Mae laid off his employees, including his co-founders, and then went back on promises that it wouldn’t sell the users’ data, according to a TechCrunch review of both filings. He claims the company fired him a year after the acquisition when he tried to raise concerns about data privacy issues. Gray is seeking backpay and punitive damages in the suit, plus legal costs. 

Gray told TechCrunch that before he agreed to the sale, he believed Sallie Mae would be prohibited from disclosing or selling non-public personal information about Scholly customers to third parties because it was a federally regulated financial institution.  

Techcrunch event

San Francisco, CA
|
October 13-15, 2026

Now he alleges that his acquirer got around any such regulations by putting Scholly into a subsidiary that is selling the data — including age, gender, race, and other indicators of an individual’s financial need — to third parties like universities and advertisers, possibly without students’ full awareness.  

“I sold Scholly to a regulated bank because I believed it would protect the students who trusted us,” Gray told TechCrunch. “Instead, I watched the company build a non-bank subsidiary to do things the bank itself can’t legally do: sell student data. That’s not the company I thought I was joining.”  

Sallie Mae denied Gray’s allegations, calling them “without merit” and declined to answer TechCrunch’s questions about its data privacy practices. 

“While we don’t comment on pending litigation, it’s unfortunate a former employee is making false accusations about our company following his departure nearly two years ago. We plan to vigorously defend ourselves against these claims which are without merit or substance,” Rick Castellano, the company’s vice president of corporate communications, said in an email.  

Asked which specific accusations were “false,” Castellano declined to comment. 

From Alabama to Shark Tank

Gray grew up low-income in Birmingham, Alabama, with a single mother and two siblings. He felt the barriers to higher education were “real and immediate” for someone like him.  

Aside from being expensive, he felt he lacked access to information to help him make proper decisions about where to go and how to afford it, a pressure that only compounded after his mother lost her job in the 2008 recession.  

“That experience shaped how I thought about the scholarship system later,” he recalled, saying he began to view education and scholarship as “a problem of access rather than a problem of merit.”  

As a teenager, when the time came for him to apply for scholarships, he found the process fragmented and inefficient, he said. There was no centralized search for him to find opportunities, and when he did find a website with scholarship options, there were thousands of listings, but no reliable way to filter to see what he was actually eligible for. Not to mention the scams and outdated listings that persisted on some sites.  

Still, he applied to about 75 scholarships over the course of seven months using public computers and the internet at the library, and won around $1.3 million in scholarship funding, including from the Bill and Melinda Gates Foundation and the Coca-Cola Scholars Foundation.  

He studied economics and entrepreneurship at Drexel University and met students facing a familiar roadblock. “Students kept asking for help finding scholarships,” he told TechCrunch. “The funding existed with hundreds of millions of dollars unclaimed each year, but the search process was broken.”  

He started mapping out the eight core criteria that determined scholarship eligibility — age, location, major, GPA, race, gender, field of study, and financial need. 

“That became the foundation of Scholly’s matching algorithm,” he said.  

During his senior year, Gray, alongside Nick Pirollo and Bryson Alef, whom he met as Coca-Cola Scholars, officially launched Scholly in 2013. For just $0.99 a month, students could use the platform and filter by eligibility criteria. “That price kept the business sustainable without having to sell data or run ads,” he said.  

Scholly switched to a freemium model after Gray pitched the idea on Shark Tank. The sharks clamored over his idea in what became the “worst fight in Shark Tank history,” according to one of the hosts who invested. Scholly grew to 5 million users and made more than $30 million in cumulative revenue, Gray said. 

In March of 2023, Sallie Mae’s corporate development team reached out to Scholly. The bank had just bought the scholarship organization Nitro College a year prior and was trying to move more into the scholarship and college-planning space. “It was a natural fit,” Gray said, of why the student loan institution wanted Scholly.  

Sallie Mae bought Scholly in July 2023, brought Gray and his co-founders on board as employees, and made Gray a vice president of product management. 

In addition to promising that it would “make Scholly free for all students, families, and other users,” Sallie Mae CEO Jon Witter said in 2023 that the acquisition “allows us to harness and build on Scholly’s innovative technology to unlock future strategic growth opportunities.” 

Sallie Mae vs. “Sallie” 

For Gray, the canary in the coal mine came one year after Scholly’s acquisition.  

He alleges in the suit that Sallie Mae laid off the Scholly founding team, including his co-founders, in July 2024. Around this same time, Gray claims he heard Sallie Mae executives discuss plans for selling Scholly user data in meetings.  

Gray alleges executives told him his position was safe, and that the company was just restructuring. But when he went on to raise further concerns about the possible selling of Scholly data, he claims in his suit he was fired before a scheduled meeting with Witter, the CEO, where he planned to discuss those issues.  

After his departure, around December 2024, Sallie Mae launched “Sallie.com.” This website describes itself as an “education solutions company,” and became home to the Scholly platform. It is separate from the website for Sallie Mae, which is home to the bank that makes student loans. 

The Sallie.com website says it’s owned by an entity called SLM Education Services, LLC. Gray contends in his lawsuit and whistleblower complaint that Sallie Mae is using SLM Education Services in order to sell the personal data collected by Scholly, since it is not a closely regulated financial services company like the Sallie Mae banking arm. 

Sallie.com discloses that it sells the following customer data in its privacy policy to third parties: name, phone number, email addresses, age, race, gender, education records, and geolocation data. The third parties it sells this information to, it says, include ad networks, educational institutions, brands, and companies dedicated to reselling consumer data.  

Sallie Mae also pays Sallie “for the referrral of student loan customers,” according to the Sallie.com “About” page. 

Gray argues in his complaints that the Sallie.com website may be easily confused with the official Sallie Mae website because of similar layouts and “sallie” logos, increasing the risk that students may hand over personal data to what they believe to be a bank.  

Gray’s suit goes on to allege that Sallie Mae used Scholly user data to create something called Backpack Media in March, which it bills as a “first-to-market education media network” that “offers brands efficient, scalable access to highly desirable, hard to reach audiences – Gen Z, Gen Alpha, and those involved in their purchasing decisions,” according to a Sallie press release.  

Castellano declined to comment on Backpack Media’s sources for data.

This would not be the first time a Salle Mae-affiliated company has been accused of deceptive or misleading behavior.  

A company called Navient, which split from Sallie Mae in 2014, has faced restitution orders from the Federal Deposit Insurance Corporation, Department of Justice, and the Department of Education for overcharges. It was sued by the Consumer Financial Protection Bureau and reached a $1.85 billion settlement with 39 attorneys general for over what the attorneys general described as predatory student loans.  

Gray said he knew of these past legal issues, but that he doesn’t regret the sale of Scholly as it helped make the platform free for every student. In fact, he said if he could, he would make the same decision to sell all over again. 

“But I’d also raise the same concerns again,” he said. “Because I believe we should live in a system where an executive can speak up and change the course of a company in line with the law and fair business practices.”

When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.

source

Continue Reading

Tech

Lovable launches its vibe-coding app on iOS and Android

Apple’s recent crackdown on vibe-coding apps hasn’t held up Lovable’s launch of its no-code AI app builder, which is now available as a mobile app on Apple’s and Google’s app stores.

The vibe-coding startup’s new mobile app is being pitched to would-be app builders as a way to code on the go via voice or text AI prompts that let you capture your ideas as they pop into your head. That means you can kick off Lovable to work on your random app idea from anywhere, letting its agent run autonomously after receiving your input.

The new app will also allow you to switch back and forth between your computer and phone to pick up where you left off on a given project and receive notifications when a build is ready for review.

The app’s arrival comes shortly after Apple addressed what vibe-coding apps can and can’t do on its App Store. The tech giant recently blocked updates to popular vibe-coding tools, including Replit and Vibecode, for violations of its developer guidelines.

Simply put, Apple wasn’t banning vibe-coding apps themselves, but it won’t allow apps that download new code or change their functionality, as that presents a security risk to end users. (It also means that Apple’s App Review team can’t properly vet the app during the approval process.)

Apple also temporarily removed the vibe-coding app Anything from the App Store for similar reasons, but the app returned after making changes earlier this month.  

To comply with Apple’s rules, the vibe-coding apps are no longer able to run their generated apps inside the host app. Instead, those app previews were moved to web browsers.

Lovable has also seemingly complied with these rules as its new app touts the ability to turn ideas into “working websites or web apps.”

When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.

source

Continue Reading

Tech

Australia forces Big Tech firms to pay for news or face a 2.25% tax

Australia is getting serious about making Big Tech pay for news. The country’s government unveiled draft legislation on Tuesday that would require companies like Meta, Google, and TikTok to pay for the journalism they aggregate or reshare, or face a levy on their local revenues.

Communications minister Anika Wells said at a press conference today: “People are increasingly getting their news directly from Facebook, from TikTok, and from Google.”

The proposed law, called the News Bargaining Incentive (NBI), would impose a 2.25% levy on the Australian revenues of the three platforms unless they strike commercial deals with local news publishers. Plus, the more deals they make with media outlets, the less they pay. If enough agreements go through, that effective rate drops to 1.5%, which could generate between A$200 million and A$250 million back into Australian journalism.

“Journalists are the lifeblood of Australia’s media sector, playing a vital role in keeping communities informed about the news that matters to them,” Prime Minister Anthony Albanese said in a statement.

It is the country’s second attempt to force Big Tech to fund journalism. The Australian government introduced the News Media Bargaining Code, which officially came into effect in 2021, requiring platforms like Google and Meta to pay news publishers. But the original version had a flaw that Big Tech companies could simply remove news from their platforms to avoid paying. Meta did that in 2024, and that move, reportedly, triggered widespread job cuts across Australian newsrooms.

Meta’s decision to pull news content in 2024 left a pretty obvious gap in Australia’s media rules. The NBI is the government’s attempt to fix it, and this time, there’s no workaround. Platforms get taxed whether they carry news or not. The Albanese government first announced the NBI in December 2024 as a replacement for the existing 2021 Code, and the draft legislation finally landed today.

TikTok’s inclusion marks a notable expansion from the Code. And the draft legislation explicitly excludes AI services. Assistant treasurer Daniel Mulino said at today’s press conference that AI “is not included in the scope of this measure” because “AI is currently being examined through a range of other policy forums, including, for example, the work on copyright being led by the Attorney-General.”

Techcrunch event

San Francisco, CA
|
October 13-15, 2026

The Trump administration has consistently opposed digital services taxes on U.S. tech companies, repeatedly threatening tariffs against countries that push ahead with them. Most recently, Trump has warned the U.K. that it could face steep tariffs unless London drops its digital services tax on U.S. tech giants that derive value from British users, including Google, Meta, and Apple.

When a journalist asked about the pushback from the White House, Albanese said at the press conference, “We’re a sovereign nation, and my Government will make decisions based upon the Australian national interest. We do that right across the board.”

If passed in Australia, platforms have until July to comply, the same date the levy kicks in.

Australia isn’t alone in this fight. Canada, Brazil, and the EU have all taken on Big Tech over news, with mixed results. Canada’s 2023 law prompted Meta to pull news from its platform entirely. Brazil’s bill has been stuck in legislative limbo since 2019. The EU has rules on the books, but enforcement varies widely. South Africa may offer the clearest blueprint — regulators there brokered direct deals with Google, Meta, TikTok, and Microsoft, securing roughly $40 million for local news outlets over five years.

Meta, Google, and TikTok did not immediately respond to requests for comment.

When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.

source

Continue Reading