Former US defence contractor ordered to pay $10M after selling hacking tools to Russian broker

Peter Williams, a former cybersecurity executive who once led the hacking and surveillance technology division at U.S. defence contractor L3Harris, has been ordered to pay $10 million to his former employer after being convicted in a major cyberespionage and trade-secrets case.

The restitution order was issued on Wednesday and comes in addition to the $1.3 million Williams had already been directed to repay to L3Harris. The case has been described as one of the most damaging leaks of advanced cyber capabilities involving the United States and its closest intelligence allies. Williams, a 39-year-old Australian citizen and former employee of an Australian intelligence agency, previously served as the general manager of Trenchant, the cyber operations division of L3Harris. The unit was created following the acquisition of two cybersecurity startups and specialised in developing sophisticated spyware, surveillance tools, and hacking technologies for the U.S. government and allied intelligence agencies. Trenchant’s customers included members of the Five Eyes intelligence alliance, the long-standing intelligence-sharing partnership between the United States, Australia, Canada, New Zealand, and the United Kingdom.

Veteran cybersecurity journalist Kim Zetter first reported details of the new restitution ruling through her newsletter.

Williams was arrested last year and accused of stealing seven highly sensitive trade secrets from Trenchant. While prosecutors did not publicly specify the exact technologies involved, the stolen materials are believed to have included cyber exploits — malicious code designed to exploit software vulnerabilities — as well as surveillance and hacking tools.

According to prosecutors, Williams sold the stolen technologies to Operation Zero, a Russian exploit broker that buys and sells cyber intrusion tools. Operation Zero has publicly stated that it works exclusively with the Russian government and domestic Russian organisations.

Williams later pleaded guilty to the charges and was sentenced to more than seven years in prison.

Court filings revealed that Williams earned approximately $1.3 million from selling the stolen trade secrets. Prosecutors said he used the money to purchase luxury watches, a home near Washington, D.C., and expensive family vacations. L3Harris told prosecutors the company may have suffered losses of up to $35 million as a result of the theft and exposure of its cyber capabilities.

U.S. prosecutors argued that Williams had “betrayed” both the United States and its allies by handing over offensive cyber tools to what officials described as “one of the world’s most nefarious exploit brokers.” Authorities warned that the stolen technologies could have been used to target millions of computers and devices globally.

Earlier reporting also revealed that some of the stolen hacking tools were eventually used in cyber operations linked to Russian intelligence agencies operating in Ukraine. Former L3Harris employees later recognised portions of the stolen code in cybersecurity research published by Google, which had investigated cyberattacks involving those tools. According to former employees, some of the same technologies later surfaced in operations tied to Chinese cybercriminal groups as well.

Investigators also alleged that Williams attempted to frame one of his own employees for the theft in an effort to avoid suspicion and cover his tracks. At the same time, the tools were being removed from the company.

Prosecutors said Williams was able to carry out the theft because of his extensive access privileges inside Trenchant’s internal systems. As part of his leadership role, he reportedly had “full access” to the company’s network infrastructure, allowing him to extract sensitive tools without immediate detection.