Ex-L3Harris executive sentenced to 87 months in prison for selling zero-day exploits to Russian broker

An ex-L3 Harris executive was sentenced to over seven years in prison Tuesday after pleading guilty to selling eight zero-day exploits to a Russian broker in exchange for millions of dollars.

Williams, 39, admitted to two counts of theft of trade secrets in U.S. District Court in Washington, D.C., last year, acknowledging he took at least eight exploits or exploit components while working at Trenchant, a specialized cybersecurity unit owned by L3Harris. Prosecutors said the materials were intended for restricted use by the U.S. government and allied partners.

Authorities said Williams sold the stolen information to a broker that advertised itself as a reseller of hacking tools and described it as serving multiple customers, including the Russian government. In court, the government referred to the buyer as “Company 3,” but details read aloud during the plea hearing pointed to Operation Zero, a Russian exploit broker that publicly markets itself online as a platform for purchasing zero-day vulnerabilities.

Additionally, Operation Zero was one of two zero-day brokerages sanctioned by the U.S. Treasury in a separate announcement made Tuesday.

Prosecutors said Williams used his access at Trenchant over roughly three years to obtain proprietary materials and entered into several deals with the broker, receiving payments in cryptocurrency. Officials said he used proceeds to buy luxury items. The Justice Department has estimated the theft caused $35 million in losses to the contractor, while prosecutors said Williams earned $1.3 million tied to the sales and should be ordered to pay that amount in restitution. 

Williams’ background added another layer noted in court. Prosecutors said he previously served in the Australian Signals Directorate, Australia’s foreign signals intelligence agency. Trenchant’s origins are also part of the record: it was formed after L3Harris acquired Azimuth Security and Linchpin Labs, Australian firms associated with exploit development.

Neither Trenchant nor L3Harris is accused of wrongdoing in the criminal case. 

A hearing for further restitution related to the $35 million in losses is scheduled for May.