How an ex-L3 Harris Trenchant boss stole and sold cyber exploits to Russia

Peter Williams, the erstwhile wide manager of Trenchant, a part of defence contractor L3Harris that develops surveillance and hacking tools for Western governments, pleaded blameworthy past week to stealing immoderate of those tools and selling them to a Russian broker.  

A tribunal papers filed successful the case, arsenic good arsenic exclusive reporting by TechCrunch and interviews with Williams’ erstwhile colleagues, explained however Williams was capable to bargain the highly invaluable and delicate exploits from Trenchant. 

Williams, a 39-year-old Australian national who was known wrong the institution arsenic “Doogie,” admitted to prosecutors that helium stole and sold 8 exploits, oregon “zero-days,” which are information flaws successful bundle that are chartless to its shaper and are highly invaluable to hack into a target’s devices. Williams said immoderate of those exploits, which helium stole from his ain institution Trenchant, were worthy $35 million, but helium lone received $1.3 cardinal successful cryptocurrency from the Russian broker. Williams sold the 8 exploits implicit the people of respective years, betwixt 2022 and July 2025. 

Thanks to his presumption and tenure astatine Trenchant, according to the tribunal document, Williams “maintained ‘super-user’ access” to the company’s “internal, access-controlled, multi-factor authenticated” secure web wherever its hacking tools were stored, and to which lone employees with a “need to know” had access.  

As a “super-user,” Williams could presumption each the activity, logs, and information associated with Trenchant’s unafraid network, including its exploits, the tribunal papers notes. Williams’ institution web entree gave him “full access” to Trenchant’s proprietary accusation and commercialized secrets. 

Abusing this wide-ranging access, Williams utilized a portable outer hard thrust to transportation the exploits retired of the unafraid networks successful Trenchant’s offices successful Sydney, Australia and Washington D.C., and past onto a idiosyncratic device. At that point, Williams sent the stolen tools via encrypted channels to the Russian broker, per the tribunal document.  

A erstwhile Trenchant worker with cognition of the company’s interior IT systems told TechCrunch that Williams “was successful the precise precocious echelon of trust” wrong the institution arsenic portion of the elder enactment team. Williams had worked astatine the institution for years, including anterior to L3Harris’ acquisition of Azimuth and Linchpin Labs, 2 sister startups that merged into Trenchant.  

“He was, successful my opinion, perceived to beryllium beyond reproach,” said the erstwhile employee, who asked to stay anonymous arsenic they were not authorized to talk about their work astatine Trenchant.  

“No 1 had immoderate supervision implicit him astatine all. He was benignant of allowed to bash things the mode helium wanted to,” they said. 

Another erstwhile employee, who besides asked to not beryllium named, said that “the wide consciousness is that whoever is the [general manager] would person unfettered entree to everything.” 

Before the acquisition, Williams worked astatine Linchpin Labs, and earlier past astatine Australian Signals Directorate, the country’s quality bureau tasked with integer and physics eavesdropping, according to the cybersecurity podcast Risky Business.  

Sara Banda, a spokesperson for L3Harris did not respond to a petition for comment.  

‘Grave damage’ 

In October 2024, Trenchant “was alerted” that 1 of its products had leaked and was successful the possession of “an unauthorized bundle broker,” per the tribunal document. Williams was enactment successful complaint of the probe into the leak, which ruled retired a hack of the company’s web but recovered that a erstwhile employee “had improperly accessed the net from an air-gapped device,” according to the tribunal document.  

As TechCrunch antecedently and exclusively reported, Williams fired a Trenchant developer successful February 2025 aft accusing him of being treble employed. The fired worker aboriginal learned from immoderate of his erstwhile colleagues that Williams accused him of stealing Chrome zero-days, which helium had nary entree to since helium worked connected processing exploits for iPhones and iPads. By March, Apple notified the erstwhile employee that his iPhone had been targeted by “mercenary spyware attack.”  

In an interrogation with TechCrunch, the erstwhile Trenchant developer said helium believed Williams framed him to screen up his ain actions. It’s unclear if the erstwhile developer is the aforesaid worker mentioned successful the tribunal document.  

In July, the FBI interviewed Williams, who told the agents that “the astir apt way” to bargain products from the unafraid web would beryllium for idiosyncratic with entree to that web to download the products to an “air‑gapped instrumentality […] similar a mobile telephone oregon outer drive.” (An air-gapped instrumentality is simply a machine oregon server that has nary entree to the internet.)  

As it turned out, that’s precisely what Williams confessed to the FBI successful August aft being confronted with grounds of his crimes. Williams told the FBI that helium recognized his codification being utilized by a South Korean broker aft helium sold it to the Russian broker; though, it remains unclear however Trenchant’s codification ended up with the South Korean broker to statesman with. 

Williams utilized the alias “John Taylor,” a overseas email provider, and unspecified encrypted apps erstwhile interacting with the Russian broker, apt Operation Zero. This is a Russia-based broker that offers up to $20 million for tools to hack Android phones and iPhones, which it says it sells to “Russian backstage and authorities organizations only.”  

Wired was archetypal to report that Williams apt sold the stolen tools to Operation Zero, fixed that the tribunal papers mentions a September 2023 station connected societal media announcing an summation successful the unnamed broker’s “bounty payouts from $200,000 to $20,000,000,” which matches an Operation Zero station connected X astatine the time.  

Operation Zero did not respond to TechCrunch’s petition for comment.  

Williams sold the archetypal exploit for $240,000, with the committedness of further payments aft confirming the tool’s performance, and for consequent method enactment to support the instrumentality updated. After this archetypal sale, Williams sold different 7 exploits, agreeing to a full outgo of $4 million, though helium ended up lone receiving $1.3 million, according to the tribunal document.  

Williams’ lawsuit has rocked the violative cybersecurity community, wherever his rumored apprehension had been a taxable of speech for weeks, according to aggregate radical who enactment successful the industry.  

Some of these manufacture insiders spot Williams’ actions arsenic causing sedate damage. 

“It’s a betrayal to the Western nationalist information apparatus, and it’s a betrayal towards the worst benignant of menace histrion that we person close now, which is Russia,” said the erstwhile Trenchant worker with cognition of the company’s IT systems told TechCrunch.  

“Because these secrets person been fixed to an adversary that perfectly is going to undermine our capabilities and is going to perchance adjacent usage them against different targets.”