A cybersecurity startup dangling thousands and thousands of {dollars} to amass zero-day safety vulnerabilities in well-liked software program is run by a pair of far-right conspiracy theorists and convicted felons whose most up-to-date ventures included pretend intelligence corporations and a now-defunct AI-based lobbying platform they operated beneath assumed names.
The X/Twitter account IRIS C2 (@C2IRIS) has gained greater than 4,000 followers since its creation in January 2025, posting ceaselessly about safety vulnerabilities, AI and software program exploits. IRIS C2 says it’s a firm in McLean, Va. that sells offensive cybersecurity capabilities.
The IRIS C2 web site dangles the potential of million-dollar payouts for exploits to draw expertise.
“Our enterprise mannequin is that this,” reads a pinned submit on high of the IRIS C2 account on X. “Entice the easiest vulnerability researchers and exploit builders on the planet to hitch our firm. This largely revolves round junior engineers with uncooked expertise/extraordinarily excessive IQ. We don’t care if they’ve a school diploma/trade expertise.”
The web site linked in that profile — irisc2[.]com — says the corporate is hiring for a variety of open positions, and a current submit on its LinkedIn web page enthuses about an awesome variety of purposes from potential workers. The web site claims IRIS C2 is within the enterprise of buying “zero-day exploits, particular person primitives, partial chains, and full capabilities throughout all main platforms. Payouts vary from $10,000 to $7 million relying heading in the right direction, reliability, and operational worth.”
The federal government contracting portal g2exchange.com experiences that irisc2[.]com is operated by a enterprise primarily based in Virginia known as Calvexa Group LLC. The “contact” hyperlink on the web site for Calvexa Group — calvexagroup[.]com — forwards guests to irisc2[.]com. G2Exchange exhibits that whereas Calvexa Group LLC is registered as a federal contractor, it doesn’t seem like engaged on any direct authorities contracts.
A search on the Arlington, Va. deal with listed within the incorporation information for Calvexa Group LLC finds the property is occupied by Jack Burkman, the 60-year-old founder and managing accomplice of the lobbying agency Burkman & Associates. When approached with questions on IRIS C2, Burkman referred additional inquiries to his longtime affiliate, 28-year-old Jacob Wohl.
Jack Burkman (left) and Jacob Wohl, at a press convention in August 2020. Picture: Wikipedia.
Burkman and Wohl have a storied historical past of making pretend intelligence corporations and utilizing them to unfold false claims about and body public figures, together with fabricated sexual assault claims in opposition to then FBI director Robert Mueller, and Pete Buttigieg, then mayor of South Bend, Indiana and a Democratic candidate for the presidency. In 2019, Burkman and Wohl held press conferences falsely alleging extramarital affairs by Sen. Elizabeth Warren (D-Mass.) and then-2020 presidential candidate Kamala Harris.
Within the wake of the 2020 presidential election, Wohl and Burkman have been prosecuted by a number of U.S. states for making 1000’s of robocalls to residents of battleground states and disseminating false claims about mail-in ballots. They have been indicted in Cleveland on 15 felony counts of orchestrating a robocall scheme geared toward suppressing the black vote in Detroit, and have been sentenced in late 2025 to probation after their appeals to dismiss the fees have been rejected.
In 2022, Wohl and Burkman each pleaded responsible to a single felony cost of telecommunications fraud in Ohio, and sentenced to a advantageous, probation, and neighborhood service. In March 2023, a decide in a New York civil case dominated that Wohl and Burkman had violated federal and state civil rights legal guidelines, and the 2 agreed to pay a $1 million settlement.
In June 2023, the Federal Communications Fee (FCC) imposed a $5.1 million advantageous in opposition to Wohl and Burkman for his or her robocall campaigns, on the time the most important advantageous ever sought by the FCC beneath the Phone Shopper Safety Act.
Jacob “Jay” Wohl’s GitHub account.
By the age of 17, Wohl had began a number of funding corporations, and cultivated the nickname “Wohl of Wall Road” after showing on Fox Information in 2015 to debate his new hedge funds. In 2017, the Arizona Company Fee charged Wohl and his funding funds with 14 counts of securities fraud, and ordered him to pay $35,000 in restitution. In 2019, Wohl pleaded responsible in California to 4 felony counts of promoting unregistered securities and was sentenced to 2 years of probation.
The marketplace for beforehand unknown safety vulnerabilities has all the time been populated by a colourful mixture of researchers, teachers, charlatans, clout-chasers and other people actively concerned in cybercrime communities. However the marketplace for promoting offensive safety providers to the U.S. authorities tends to be much more circumspect. Loads of authorities contractors recruit vulnerability researchers and pay for the unique rights to novel software program exploits, but none of them achieve this fairly as overtly and overtly as IRIS C2.
Latest posts from the Twitter/X account IRISC2 (@c2iris).
Certainly, KrebsOnSecurity was unaware of IRIS C2 till final month, when an attendee at a regional cybersecurity convention shared that Wohl and Calvexa Group have been pestering individuals on the convention about promoting their vulnerability analysis.
In an interview with KrebsOnSecurity, Wohl stated Mr. Burkman was not concerned within the day-to-day operations of IRIS C2. Wohl shared that IRIS C2 initially started as a penetration testing firm, however shifted its focus lately to promoting phone-hacking providers to the federal government. A number of occasions all through the interview, Mr. Wohl talked about engaged on federal authorities contracts, however when pressed for specifics stated he was not at liberty to talk publicly about them.
Mr. Wohl stated he doesn’t have any formal schooling or coaching in laptop science or info safety, and that almost all of his data on the matter is self-taught.
“I do know extra about tech than anybody,” Wohl bragged. “My background has all the time been extraordinarily technical, and I’ve all the time been deeply into tech. Folks know me as somebody who is ready to create spectacularly beautiful capabilities that will make your head spin.”
Wohl stated safety researchers convey the corporate distinctive vulnerability findings “frequently,” however that in lots of circumstances these findings are preliminary and never absolutely fleshed-out.
“Let’s say somebody finds a flaw in a media decoder on a cellphone,” Wohl stated. “Plenty of occasions what we obtain is an exploit primitive, the place the concept is there however the [execution] wants work. You want that exploit to be secure and dependable, and that’s what we do.”
Wohl claims IRIS C2 has roughly 40 workers, though he stated none of them are allowed to record their employment on LinkedIn for operational safety causes. In Might, the creator of the IRIS C2 account on X stated that his girlfriend had no thought what he did for a dwelling. But when IRIS C2 has another workers, they might be equally unaware of Mr. Wohl’s historical past of outright fabrications — and even his actual identify.
In September 2024, Politico reported that Burkman and Wohl have been bragging about huge corporations supposedly shopping for providers from their now-defunct firm LobbyMatic, which claimed to make use of synthetic intelligence to help in political lobbying efforts. Nevertheless, Politico discovered the pair have been operating the corporate utilizing pseudonyms, with Wohl reportedly adopting the identify “Jay Klein” and Burkman utilizing the moniker “Invoice Sanders.” Politico reported that two of the previous LobbyMatic workers resigned after studying of their true identities, whereas different workers solely discovered after that they had left the corporate.
