Felons, Fraudsters Flog Offensive Cybersecurity Startup
Summary: A Virginia-registered company called Calvexa Group LLC operates the X account IRIS C2, which since January 2025 has advertised payouts of $10,000 to $7 million for zero-day exploits and offensive capabilities, and Krebs on Security reports the business is run by Jack Burkman and Jacob Wohl, both convicted felons. Wohl told Krebs he has no formal computer science or security training, said IRIS C2 has about 40 employees who cannot list the company on LinkedIn, and claimed federal government contract work he would not describe.
Why it matters: The person soliciting vulnerability research from conference attendees has a record that includes a $5.1 million FCC robocall fine, a $1 million civil rights settlement, and felony fraud convictions, and previously ran a company under assumed names until employees resigned on learning his identity. Any researcher or buyer weighing an IRIS C2 payout is dealing with someone whose own account of the business cannot be independently verified.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026