Cyber-related Designations; CAATSA – Russia-related Designations; PAIPA Designations

Treasury Press Release: Treasury Sanctions Exploit Broker Network for Theft and Sale of U.S. Government Cyber Tools

State Press Release: Designation of Russia-Based Zero-Day Exploits Broker and Affiliates for Theft of U.S. Trade Secrets

Additions:

The following individuals have been added to OFAC’s SDN List:

OFAC Programs:

• OFAC Programs:
  • [CAATSA – RUSSIA] Countering America’s Adversaries Through Sanctions Act of 2017 (CAATSA) – Title II.
  • [CYBER4] Sanctions related to significant malicious cyber-enabled activities.

KUCHEROV, Oleg Vyacheslavovich

• AKA: “GABR”
• Address: Samara, Russia
• DOB: 03 Jun 1973
• POB: Togliatti, Russia
• Nationality: Russia
• Gender: Male
• Secondary sanctions risk: Ukraine-/Russia-Related Sanctions Regulations, 31 CFR 589.201
• Party Type: Individual
• Linked to: ZELENYUK, Sergey Sergeyevich

Supplemental Information: Oleg Kucherov is a Russian national and a suspected member of the Trickbot cybercrime gang. He is designated for his association with the Sergey Zelenyuk exploit broker network.

MAMASHOYEV, Azizjon Makhmudovich

• AKA: MAMASHOYEV, Azizjon Maxmudovich
• Address: 60 Amir Timur Avenue, Tashkent, Uzbekistan
• DOB: 20 Feb 1987
• Nationality: Uzbekistan
• Gender: Male
• Secondary sanctions risk: Ukraine-/Russia-Related Sanctions Regulations, 31 CFR 589.201
• Passport: FA2783585 (Uzbekistan) expires 16 May 2031
• National ID No.: AD3927969 (Uzbekistan)
• Party Type: Individual
• Linked to: ZELENYUK, Sergey Sergeyevich

Supplemental Information: Azizjon Mamashoyev is the founder of Advance Security Solutions, an offensive cybersecurity firm and exploit brokerage company operating in the UAE and Uzbekistan. He is a key affiliate of the Zelenyuk network.

VASANOVICH, Marina Evgenyevna

• AKA: VASANOVICH, Marina Yevgenyevna
• Address: Russia
• DOB: 21 Nov 2003
• POB: Novocherkassk, Rostovskaya Oblast, Russia
• Nationality: Russia
• Gender: Female
• Secondary sanctions risk: Ukraine-/Russia-Related Sanctions Regulations, 31 CFR 589.201
• Passport: 761424486 (Russia) expires 23 Aug 2029
• National ID No.: 40 23 685988 (Russia)
• Party Type: Individual
• Linked to: ZELENYUK, Sergey Sergeyevich

Supplemental Information: Marina Vasanovich is an assistant to Sergey Zelenyuk. She is designated for being owned or controlled by, or having acted for or on behalf of, Zelenyuk in the operation of his exploit brokerage activities.

OFAC Programs:

• OFAC Programs:
  • [CAATSA – RUSSIA] Countering America’s Adversaries Through Sanctions Act of 2017 (CAATSA) – Title II.
  • [CYBER4] Sanctions related to significant malicious cyber-enabled activities.
  • [PAIPA] Protecting American Intellectual Property Act of 2022.

ZELENYUK, Sergey Sergeyevich

• AKA:
  • ZELENYUK, Sergei Sergeevich
  • ZELENYUK, Sergey Sergeevich
  • “MORTENOIR”
  • “SRGSRGSRG111”
• Address: Rimsky-Korsakov Prospect, Building 109-111, Litera/Block A, Apartment 20, Saint Petersburg 190068, Russia
• DOB: 17 Mar 1994
• POB: Saint Petersburg, Russia
• Nationality: Russia
• Gender: Male
• Secondary sanctions risk: Ukraine-/Russia-Related Sanctions Regulations, 31 CFR 589.201
• PAIPA Section 2 Information: BLOCKING OF PROPERTY (individual). Sec.2(b)(2)(a)- All property and interests in property of this individual are blocked, and all transactions with this individual are prohibited, except for the importation of goods.
• Tax ID No.: 780223642330 (Russia)
• Party Type: Individual

Supplemental Information: Sergey Zelenyuk is the director and sole owner of Matrix LLC (doing business as Operation Zero). He is an exploit broker who acquired at least eight proprietary U.S. government cyber tools stolen from defense contractor L3Harris Technologies (specifically its subsidiary Trenchant) by former employee Peter Williams. Zelenyuk paid Williams millions in cryptocurrency for these “zero-day” exploits and subsequently resold them to unauthorized users, including the Russian government. This action marks the first individual designation under the Protecting American Intellectual Property Act (PAIPA).

The following entities have been added to OFAC’s SDN List:

OFAC Programs:

• OFAC Programs:
  • [CAATSA – RUSSIA] Countering America’s Adversaries Through Sanctions Act of 2017 (CAATSA) – Title II.
  • [CYBER4] Sanctions related to significant malicious cyber-enabled activities.

ADVANCE SECURITY SOLUTIONS

• AKA: “ADVANCED SECURITY SOLUTIONS”
• Address:
  • R-311-315, Jumeirah Living Marina Gate 3, P.O. Box 121828, Dubai, United Arab Emirates
  • Tashkent, Uzbekistan
• Website: advance-sec.com
• Secondary sanctions risk: Ukraine-/Russia-Related Sanctions Regulations, 31 CFR 589.201
• Organization Established Date: 2025
• Organization Type: Computer programming activities
• Linked to: MAMASHOYEV, Azizjon Makhmudovich

Supplemental Information: Advance Security Solutions is a Dubai- and Uzbekistan-based company that functions as an offensive cybersecurity firm and exploit broker. It was founded by Azizjon Mamashoyev and works within the broader network managed by Sergey Zelenyuk to acquire and market vulnerabilities in U.S.-built software.

OFAC Programs:

• OFAC Programs:
  • [CAATSA – RUSSIA] Countering America’s Adversaries Through Sanctions Act of 2017 (CAATSA) – Title II.
  • [CYBER4] Sanctions related to significant malicious cyber-enabled activities.
  • [PAIPA] Protecting American Intellectual Property Act of 2022.

MATRIX LLC

• AKA:
  • LLC MATRITSA
  • MATRIX LIMITED
  • MATRIX LTD
  • OPERATION ZERO
  • OPZERO
• Address: Sh. Petergofskoe, 73, Letter T, Office 26/1, Room 1, Municipal District Sosnovaya Polyana, Saint Petersburg 198206, Russia
• Website: opzero.ru
• Secondary sanctions risk: Ukraine-/Russia-Related Sanctions Regulations, 31 CFR 589.201
• Organization Established Date: 27 Sep 2021
• Organization Type: Computer programming activities
• PAIPA Section 2 Information:
  • BLOCKING OF PROPERTY (entity): Sec.2(b)(1)(A) – All property and interests in property of this entity are blocked, and all transactions with this entity are prohibited, except for the importation of goods.
  • LOANS FROM UNITED STATES FINANCIAL INSTITUTIONS: Sec.2(b)(1)(D) – United States financial institutions are prohibited from making loans or providing credits to this entity totaling more than $10,000,000 in any 12-month period, subject to the exception set forth in PAIPA Section 2(b)(1)(D).
  • FOREIGN EXCHANGE: Sec.2(b)(1)(H) – Transactions in foreign exchange that are subject to the jurisdiction of the United States and in which this entity has any interest are prohibited.
  • BANKING TRANSACTIONS: Sec.2(b)(1)(I) – Any transfers of credit or payments between financial institutions or by, through, or to any financial institution, to the extent that such transfers or payments are subject to the jurisdiction of the United States and involve any interest of this entity, are prohibited.
  • BAN ON INVESTMENT IN EQUITY OR DEBT OF SANCTIONED PERSON: Sec.2(b)(1)(J) – Any United States person is prohibited from investing in or purchasing significant amounts of equity or debt instruments of this entity.
• Tax ID No.: 7807251301 (Russia)
• Registration Number: 1217800148609 (Russia)

SPECIAL TECHNOLOGY SERVICES LLC FZ

• Address: Meydan Grandstand, 6th Floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates
• Secondary sanctions risk: Ukraine-/Russia-Related Sanctions Regulations, 31 CFR 589.201
• Organization Established Date: 07 Dec 2024
• Organization Type: Computer programming activities
• PAIPA Section 2 Information:
  • BLOCKING OF PROPERTY (entity): Sec.2(b)(1)(A) – All property and interests in property of this entity are blocked, and all transactions with this entity are prohibited, except for the importation of goods.
  • LOANS FROM UNITED STATES FINANCIAL INSTITUTIONS: Sec.2(b)(1)(D) – United States financial institutions are prohibited from making loans or providing credits to this entity totaling more than $10,000,000 in any 12-month period, subject to the exception set forth in PAIPA Section 2(b)(1)(D).
  • FOREIGN EXCHANGE: Sec.2(b)(1)(H) – Transactions in foreign exchange that are subject to the jurisdiction of the United States and in which this entity has any interest are prohibited.
  • BANKING TRANSACTIONS: Sec.2(b)(1)(I) – Any transfers of credit or payments between financial institutions or by, through, or to any financial institution, to the extent that such transfers or payments are subject to the jurisdiction of the United States and involve any interest of this entity, are prohibited.
  • BAN ON INVESTMENT IN EQUITY OR DEBT OF SANCTIONED PERSON: Sec.2(b)(1)(J) – Any United States person is prohibited from investing in or purchasing significant amounts of equity or debt instruments of this entity.
• Linked to: ZELENYUK, Sergey Sergeyevich

Supplemental Information: Matrix LLC (operating as Operation Zero) and Special Technology Services LLC FZ (STS) are the first entities sanctioned under the Protecting American Intellectual Property Act (PAIPA). Matrix LLC is a Russian-based broker that acquired eight sensitive zero-day exploits stolen by Peter Williams from L3Harris Trenchant. STS was established by Zelenyuk in the UAE to expand his brokerage business into Asia and the Middle East and to circumvent U.S. sanctions on Russian financial accounts. These entities facilitate the distribution of tools used for espionage, theft, and sabotage against U.S. interests.