IRIS C2 Zero-Day Marketplace: How Two Convicted Fraudsters Jack Berkman and Jacob Wohl Launched a Government-Facing Exploit Trading Operation
IRIS C2, a newly emerged Virginia company, has drawn scrutiny from cybersecurity journalist Brian Krebs for its bold claims of purchasing zero-day vulnerabilities and selling offensive cyber tools to governments while being led by two individuals with documented histories of fraud and deception.
The firm appeared on social media in January 2025 and quickly began publishing content about vulnerabilities, artificial intelligence, and hacking tools. On its website, IRIS C2 presents itself as a provider of offensive cyber capabilities based in McLean, Virginia, offering rewards ranging from $10,000 to $7 million for zero-day exploits, exploit chain components, and fully developed attack tools targeting major software platforms.
The company actively recruits young researchers skilled at finding vulnerabilities and developing exploits, emphasizing that formal education or prior work experience is unnecessary and that talent and high intelligence are the primary criteria. According to data from the government contracting portal G2Exchange, the IRIS C2 website is managed by Calvexa Group LLC, a registered federal contractor in Virginia, although no direct government contracts appear in public records.
Founders' Criminal Background and Deceptive Practices
The address of Calvexa Group is linked to lobbyist Jack Berkman, who directed inquiries about IRIS C2 to his longtime partner Jacob Wohl. Both men have previously created fictitious intelligence companies, disseminated false accusations against American politicians, and participated in illegal robocall campaigns.
In 2022, Berkman and Wohl pleaded guilty to wire fraud charges in Ohio, receiving fines, probation, and community service. The Federal Communications Commission later imposed a $5.1 million penalty on the pair for robocall operations that spread false information about mail-in voting.
Wohl told KrebsOnSecurity that IRIS C2 initially focused on penetration testing before shifting to selling phone-hacking tools to government entities. He stated that the company takes vulnerabilities discovered by external researchers and develops them into stable, practically usable attack tools. Approximately 40 employees work at the firm, with instructions not to list IRIS C2 on LinkedIn, although independent verification of staff numbers has not been possible.
Neither Wohl nor Berkman holds formal education in computer science or information security; Wohl claims to have acquired the necessary knowledge independently. Earlier, the pair operated LobbyMatic, a platform allegedly using artificial intelligence for political lobbying, where they concealed their real identities from employees and clients, leading several staff members to resign upon discovering the true leadership.
In March 2026, journalist Molly White reported that Berkman and Wohl received $300,000 from an individual accused of stealing $65 million from cryptocurrency platforms KyberSwap and Indexed Finance, in exchange for efforts to secure a presidential pardon.
Related articles
Exploiting CVE-2025-55182 React2Shell Vulnerability on Hack The Box Reactor Machine
A detailed walkthrough demonstrates remote code execution against a seasonal Hack The Box machine named Reactor by abusing the critical Next.js deserialization flaw CVE-2025-55182, also known as React2Shell. The attack begins with Nmap reconnaissance revealing an exposed Next.js service on port 3000, followed by Wappalyzer identification of an outdated framework version. Public exploit code is used to obtain an initial reverse shell as the node user without authentication. Credential access is achieved by extracting password hashes from the reactor.db SQLite database and cracking the engineer account with Hashcat against rockyou.txt. Privilege escalation leverages an exposed Node.js Inspector debug port on 9229, allowing WebSocket interaction via websocat to set the SUID bit on /bin/bash and obtain root access. The article highlights both the impact of the unauthenticated RCE vulnerability and common misconfigurations such as forgotten debug ports on production systems.
CISA Adds MikroTik RouterOS Flaws CVE-2026-67277 and CVE-2026-86060 to Known Exploited Vulnerabilities Catalog
The US Cybersecurity and Infrastructure Security Agency has added two actively exploited vulnerabilities in MikroTik RouterOS to its Known Exploited Vulnerabilities Catalog. CVE-2026-86060 stems from improper sanitization of command argument delimiters and can lead to privilege escalation after an attacker gains access to the SSH login helper and alters trusted policy masks. CVE-2026-67277 involves missing authentication checks in critical RouterOS functions, allowing connections before authentication completes and potentially leaking kernel memory or causing denial-of-service conditions. CISA directed US federal agencies to apply mitigations by September 13 and specifically investigate any signs of compromise related to CVE-2026-86060. The agency noted that the flaws carry broader exploitation risk and urged all organizations using affected MikroTik products to take immediate action.
The Birth of CVE: How Two MITRE Engineers Built the Universal Vulnerability Identifier in 1999
In the late 1990s, security teams faced chaos with one vulnerability carrying dozens of incompatible names across scanners, IDS tools, and CERT advisories. Two MITRE engineers, David E. Mann and Steven M. Christey, proposed a minimal Common Vulnerabilities and Exposures list to solve correlation problems without imposing taxonomy or risk models. Their January 1999 paper led to a Purdue workshop, the formation of the CVE Editorial Board, and a public launch on September 29, 1999, with 321 initial entries. The design deliberately avoided ownership by any vendor and kept names as simple CVE-year-number strings. This neutral, open approach allowed competing vendors to map their proprietary databases to a shared reference without agreeing on classifications. The same minimalist philosophy later influenced NVD, OSV, and GitHub Advisory Database.
OnePlus 13R Preinstalled Account App Leaks Cloud Session Tokens to Any App Declaring Required Permission
Researchers at Doyensec identified a vulnerability in the preinstalled com.oneplus.account application on the OnePlus 13R that allows any third-party app to steal a valid OnePlus Cloud session token. The flaw stems from the OPAccountProvider component lacking the protectionLevel="signature" attribute on its declared permission com.oneplus.account.READ_ACCOUNT_INFO, enabling any app to request the permission and query the provider directly. Once obtained, the token grants access to OnePlus Cloud APIs without further user interaction or warnings. Doyensec responsibly disclosed the issue on 30 December 2025, leading OnePlus to acknowledge the high-severity problem and pay a $720 bounty in March 2026. Follow-up testing in September on firmware CPH2691_16.0.10.500(EX01) confirmed the token leakage persists, although full account takeover via the regional API was no longer reproducible for US and EMEA accounts due to backend changes. Users are advised to avoid untrusted apps and apply future updates, while OnePlus needs only to add the signature protection level to close the exposure.