IRIS C2: The $7M Zero-Day Bounty and the Rise of Shadow Exploit Brokers

Executive Summary

The commercial exploit market has seen a disruptive new entry with the emergence of IRIS C2, a Virginia-based brokerage offering bounties of up to $7 million for high-tier zero-day exploits. Recent intelligence indicates the firm is aggressively recruiting non-traditional talent to acquire full-chain exploits for iOS, Android, and enterprise-grade networking equipment. The firm’s lack of traditional government vetting and its leadership by controversial political operatives raise significant concerns regarding the eventual destination and use of these offensive capabilities. IRIS C2 operates under the Calvexa Group LLC umbrella, positioning itself as a premier provider of offensive cyber capabilities while remaining outside the traditional defense contracting ecosystem.

Threat Analysis

IRIS C2 represents the professionalization of the "gray market" for zero-day vulnerabilities. By offering payouts that rival or exceed state-sponsored programs and established brokers like Zerodium or Crowdfense, they attract researchers who might otherwise report through responsible disclosure channels. The threat is amplified by the firm's focus on "raw talent" over industry credentials, potentially creating a pipeline for unvetted individuals to contribute to a massive arsenal of offensive tools. This ecosystem facilitates the proliferation of mercenary spyware, where sophisticated surveillance tools are sold to the highest bidder, regardless of human rights or international norms. The convergence of high-stakes exploit brokering with individuals known for influence operations suggests a dangerous new phase in digital warfare.

Technical Details

The IRIS C2 procurement list is comprehensive, focusing on three primary categories: mobile OS full chains, browser-based remote code execution (RCE), and enterprise control-plane vulnerabilities. Technical requirements for a $7 million payout include zero-click persistence on latest-generation iOS and Android builds, capable of bypassing modern mitigations like PAC and blast-door protections. The firm is also actively seeking "primitives"—the building blocks of an exploit—such as memory corruption bugs or sandbox escapes, which they then assemble into full capabilities. Of particular concern is the firm's recent interest in vulnerabilities similar to CVE-2026-20245 (Cisco Catalyst SD-WAN Manager), suggesting a strategic shift toward infrastructure-level surveillance that could compromise entire enterprise networks by targeting management surfaces.

Attribution Assessment

Analysis of corporate filings and digital footprints identifies IRIS C2 as a front for Calvexa Group LLC, based in McLean, Virginia. The operation is directed by Jack Burkman and Jacob Wohl, individuals previously known for orchestrating domestic influence operations and robocall schemes, often using pseudonyms such as "Bill Sanders" and "Jay Klein." While the group claims to sell only to legitimate offensive security entities, their history of using deceptive identities and operating "fake" intelligence companies like LobbyMatic suggests a high risk of opaque tradecraft. There is currently no evidence of direct U.S. federal contracts, positioning them as an independent and potentially volatile actor in the global exploit trade, likely catering to foreign governments or private intelligence firms.

Implications

The entry of high-payout, low-oversight brokers into the market destabilizes the global cybersecurity posture. When zero-days are commoditized at this scale, the "shelf life" of secure systems decreases as researchers are incentivized to withhold fixes. Furthermore, the convergence of exploit development with individuals experienced in influence operations suggests a future where cyber tools are not just used for espionage, but for coordinated psychological and political warfare. This marks a new era of "Mercenary Intelligence Operations" where the boundary between a cybercriminal group and a private intelligence firm becomes indistinguishable, creating a scalable model for state-level surveillance that can be purchased by non-state actors.

Recommendations

Organizations must adopt a zero-trust architecture and prioritize the immediate patching of management-plane vulnerabilities, particularly in SD-WAN and VPN infrastructure. Threat intelligence teams should monitor for indicators associated with Calvexa Group infrastructure and IRIS C2 recruitment channels. At the policy level, there is an urgent need for enhanced regulation of the exploit brokerage market to ensure that offensive capabilities are not funneled to malicious actors or used to bypass international sanctions. Finally, high-risk individuals should utilize hardware-backed security measures like Apple’s Lockdown Mode to mitigate the effectiveness of the mobile chains being acquired by these brokers.