IRIS C2, a cybersecurity startup actively seeking zero-day exploits with promises of substantial payouts, is reportedly led by individuals with a history of felony convictions and fraudulent operations. The company, which operates under the guise of IRIS C2 and is linked to Calvexa Group LLC, advertises on platforms like X (formerly Twitter) and its own website, irisc2[.]com, offering between $10,000 and $7 million for vulnerabilities. The company claims to attract talented but often inexperienced engineers, focusing on acquiring 'zero-day exploits, individual primitives, partial chains, and full capabilities.'
Investigations reveal that the address associated with Calvexa Group LLC is linked to Jack Burkman, a known figure in right-wing politics and lobbying. Burkman, when questioned, deferred inquiries to his associate, Jacob Wohl. Burkman and Wohl have a documented past of creating fictitious companies and disseminating false information, including fabricating sexual assault allegations and spreading misinformation about election integrity. They have faced legal repercussions, including indictments for orchestrating robocall schemes, telecommunications fraud convictions, and significant civil settlements and FCC fines.
Wohl, who has been associated with various investment ventures and faced securities fraud charges, claims to be self-taught in cybersecurity and asserts his deep technical expertise. He stated that IRIS C2 initially focused on penetration testing but has shifted to providing phone-hacking services to the government. Wohl indicated that the company has around 40 employees, who are kept off professional networking sites for operational security reasons.
Despite claims of working on federal contracts, specifics remain undisclosed. The company's recruitment strategy, openly soliciting vulnerability researchers and offering high payouts, stands in contrast to the more discreet practices typically employed by government contractors in the cybersecurity sector.
Past ventures by Burkman and Wohl, such as the defunct AI lobbying platform LobbyMatic, were also operated under pseudonyms, with Wohl reportedly using 'Jay Klein' and Burkman 'Bill Sanders.' This pattern of deception has led to former employees resigning or only discovering the true identities of their employers after their departure.
The market for cybersecurity exploits is known to attract a diverse range of individuals, but the public profile and the backgrounds of the individuals behind IRIS C2 raise significant questions about the legitimacy and ethical implications of their operations.
