Peter Williams, a 39-year-old Australian national and former general manager at Trenchant, was sentenced on February 24, 2026, to 87 months in federal prison after pleading guilty to stealing and selling sensitive cyber-exploit components. The U.S. Department of Justice said Williams transferred at least eight components through encrypted channels to a Russian cyber-tools broker, received cryptocurrency, and caused approximately $35 million in losses to his former defense-contractor employer.
The government’s releases describe the stolen material as protected cyber-exploit components and national-security software. “Zero-day exploits” is common shorthand in coverage, but the public record does not identify the vulnerabilities, affected products, exploit chains, or confirmed victims.
As an Amazon Associate I earn from qualifying purchases.
What sentence did Peter Williams receive?
Williams was sentenced in the U.S. District Court for the District of Columbia on February 24, 2026. His sentence includes:
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →- 87 months in federal prison
- Three years of supervised release, subject to special conditions
- $1.3 million in restitution
- $1.3 million in forfeitures, including cryptocurrency and property
The forfeited property included a house, vehicles, jewelry, watches, and other luxury goods, according to the U.S. Attorney’s Office for the District of Columbia.
#1 Best Overall
Williams had pleaded guilty on October 29, 2025, to two counts of theft of trade secrets. Each count carried a statutory maximum of 10 years in prison and a fine of up to $250,000 or twice the pecuniary gain or loss, according to the Justice Department’s plea announcement.
Although 87 months equals seven years and three months, an exact release date cannot be inferred from the sentence alone. Federal custody timing can depend on Bureau of Prisons calculations, credit, and other applicable rules.
Who is Peter Williams?
The Justice Department described Williams as a former general manager for a U.S. defense contractor. CyberScoop identified that employer as Trenchant, a cyber unit associated with L3Harris after its acquisition of Australian exploit-development companies Azimuth Security and Linchpin Labs.
Recommended Free Tools
Williams’ position gave him access to sensitive cyber capabilities and secure company systems. The available materials describe the criminal conduct as an insider theft case: he allegedly used legitimate access to obtain protected software and then commercialized it. L3Harris and Trenchant were not accused of criminal wrongdoing in the cited materials.
What did Williams steal?
According to the Justice Department, Williams stole at least eight sensitive cyber-exploit components between approximately April 2022 and August 2025. The material was proprietary software intended for sale only to the U.S. government and selected allied governments.
Rank #2
The public record says the components were connected to national-security and cyber-intelligence capabilities. It does not establish:
- Which vulnerabilities were involved
- Whether the components affected browsers, mobile devices, operating systems, or particular applications
- Whether each item was a complete exploit, an exploit chain, or one part of a larger capability
- Whether a named government or private-sector victim was successfully compromised
- Whether the Russian government operationally used any particular stolen component
A zero-day vulnerability is generally a software flaw unknown to, or not yet fixed by, its vendor. An exploit is code or a technique that takes advantage of a vulnerability. The term “zero-day exploits” may accurately describe some of the reported capabilities, but the primary government releases use the more cautious terms “cyber-exploit components,” “trade secrets,” and “national-security software.”
Free tools Windows power users keep installed
One-click scans. No signup required.
How the alleged sales worked
This was not described as a single accidental disclosure. The Justice Department said Williams entered multiple written contracts with the broker. Those agreements covered the initial sale of the stolen material and periodic payments for follow-on support.
The alleged process involved:
- Using access to the contractor’s secure network to obtain the components.
- Entering contracts with the broker for the capabilities and continuing support.
- Transferring the material through encrypted means.
- Receiving cryptocurrency payments.
- Using some of the proceeds for high-value personal purchases.
The government said the contracts were worth up to $4 million in cryptocurrency. Williams received approximately $1.3 million for the specific exploits, according to the sentencing materials.
Understanding the money figures
| Amount | What it represents |
|---|---|
| Up to $4 million | The potential value of the contracts, according to the Justice Department |
| $1.3 million | The amount Williams received for the specific exploits and the amount tied to the money judgment and restitution order |
| Approximately $35 million | The government’s estimated loss to the defense contractor |
These figures measure different things. The $35 million figure is the government’s loss estimate, not a public technical valuation of every exploit. The $1.3 million figure relates to Williams’ proceeds and financial orders in the criminal case. The contract value of up to $4 million refers to the agreements’ potential value, rather than necessarily the amount he collected.
Who was the Russian broker?
Public court materials referred to the intermediary as “Company 3.” The U.S. Treasury Department identified the network as Sergey Sergeyevich Zelenyuk, Matrix LLC, and Operation Zero.
Treasury said Operation Zero had operated as an exploit broker since at least 2021, offered rewards for exploits affecting U.S.-built software, and sold cyber tools to customers that included the Russian government. Treasury also said the network acquired at least eight proprietary tools stolen from a U.S. company and later sold them to at least one unauthorized user.
That description supports calling Operation Zero a Russian cyber-tools broker or intermediary. It does not, based on the cited public releases alone, establish that the Russian government bought or deployed every component stolen by Williams. It also does not identify the unauthorized buyer or confirm the operational use of the tools.
Criminal prosecution and sanctions were separate actions
Williams’ sentencing and Treasury’s sanctions announcement occurred on the same day, but they were separate legal actions involving different parties.
The criminal case addressed Williams’ theft of trade secrets and the proceeds from that conduct. Treasury’s action targeted Zelenyuk, Matrix LLC, Operation Zero, and associated individuals and entities. Treasury described the action as its first under the Protecting American Intellectual Property Act.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesTogether, the actions show two government responses to the same broader market: criminal prosecution of an insider who supplied protected capabilities and financial sanctions against an intermediary accused of brokering offensive cyber tools.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Why the case matters to cybersecurity and defense companies
Privileged access creates insider risk
The case illustrates a risk that perimeter defenses alone cannot solve. A person with authorized access to exploit-development systems may be able to copy valuable material without conducting an external intrusion.
For defense contractors and cyber-tool developers, relevant controls can include strict privilege management, repository segmentation, monitoring of unusual downloads, controls on removable media and personal devices, review of encrypted data transfers, and heightened monitoring during employee departures. These are general risk-management implications, not findings that the cited court materials establish a particular security failure at L3Harris or Trenchant.
Exploit development has a commercial supply chain
The case also shows how offensive cyber capabilities can move through brokers rather than directly from a developer to a government customer. Prosecutors have compared international cyber brokers to a new wave of arms dealers. That is a prosecutor’s characterization, but it captures the policy concern: software capabilities developed for restricted government use can become tradable assets when insiders, intermediaries, and cryptocurrency payments connect the supply chain.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Support obligations can extend the exposure
The alleged follow-on support contracts are significant. A sale of source material or an exploit component may create continuing obligations to troubleshoot, modify, or maintain the capability. That can increase both the value of the transaction and the duration of the insider threat.
Best Value
What remains unknown
The public announcements do not disclose the CVE numbers, affected vendors, products, exploit chains, or confirmed victims. They also do not establish that a specific U.S. government system was breached using the stolen tools.
Readers should therefore distinguish among three different claims:
- Established in the case: Williams stole at least eight protected cyber-exploit components and transferred them to a broker.
- Reported by authorities about the broker: Operation Zero sold cyber tools to customers including the Russian government and sold the stolen tools to at least one unauthorized user.
- Not publicly established in the cited materials: the identity of the buyer, the identity of any victim, and whether the Russian government deployed a particular stolen component.
A statement from U.S. Attorney Jeanine Pirro that the tools could have enabled access to millions of devices should be understood as an attributed government assessment, not as an independently verified technical description of the capabilities.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Bottom line
Peter Williams’ 87-month sentence closes the publicly reported criminal case against the insider, while Treasury’s sanctions target the broker network that authorities linked to the transactions. The case demonstrates the financial and national-security consequences of stealing restricted offensive cyber capabilities, but it is not a public technical disclosure of named zero-days or proof of a specific victim compromise.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
