Convicted Felons Jack Burkman and Jacob Wohl Launch Zero-Day Exploit Firm IRIS C2

IRIS C2, a cybersecurity startup offering payouts up to $7 million for zero-day software vulnerabilities, is operated by convicted felons Jack Burkman and Jacob Wohl. According to reporting by KrebsOnSecurity, the duo—known for orchestrating fraudulent intelligence schemes and illegal robocall campaigns—runs the entity via Calvexa Group LLC, a Virginia-based federal contractor with no active government contracts.

IRIS C2 Business Model and Recruitment Tactics

IRIS C2 claims to acquire “zero-day exploits, individual primitives, partial chains, and full capabilities” across all major digital platforms. The company’s website, irisc2[.]com, lists payouts ranging from $10,000 to $7 million based on the target’s value and the reliability of the exploit. Through its X (formerly Twitter) account @C2IRIS, the firm specifically targets “junior engineers with raw talent/extremely high IQ,” stating that college degrees and industry experience are not required.

Jacob Wohl told KrebsOnSecurity that IRIS C2 transitioned from a penetration testing company to a firm selling phone-hacking services to the government. While Wohl claims the company employs approximately 40 people, he stated that employees are forbidden from listing the firm on LinkedIn for operational security reasons. Wohl further asserted that he is “self-taught” in computer science and information security, claiming his technical capabilities are “spectacularly exquisite.”

Legal History of Jack Burkman and Jacob Wohl

The operators of IRIS C2 have a documented history of legal convictions and civil penalties related to fraud and disinformation:

• Robocall Fraud: In 2022, Burkman and Wohl pleaded guilty to felony telecommunications fraud in Ohio for orchestrating robocalls that disseminated false information about mail-in ballots. According to the FCC, the agency imposed a $5.1 million fine against the pair in June 2023, the largest fine ever sought under the Telephone Consumer Protection Act.
• Civil Rights Violations: A New York judge ruled in March 2023 that the pair violated federal and state civil rights laws, resulting in a $1 million settlement.
• Securities Fraud: Jacob Wohl pleaded guilty in California in 2019 to four felony counts of selling unregistered securities and was sentenced to two years of probation. He was previously charged by the Arizona Corporation Commission with 14 counts of securities fraud.
• Fabricated Intelligence: The pair previously created fake intelligence companies to spread false claims against public figures, including then-FBI Director Robert Mueller and Pete Buttigieg.

Pattern of Pseudonyms and Defunct Ventures

The launch of IRIS C2 follows a pattern of the pair operating under assumed identities to hide their backgrounds. Politico reported in September 2024 that Burkman and Wohl operated a now-defunct AI-based lobbying platform called LobbyMatic using the names “Bill Sanders” and “Jay Klein.” Politico noted that some employees resigned only after discovering the founders’ true identities.

More recently, journalist Molly White reported on March 31 that the pair received a $300,000 retainer from a Canadian cryptocurrency fraudster. The hire was reportedly intended to help the fraudster, who is wanted by the U.S. for allegedly stealing $65 million from KyberSwap and Indexed Finance, secure a presidential pardon.

The Risks of Unverified Exploit Brokers

The market for zero-day vulnerabilities typically consists of academic researchers and established cybersecurity firms. However, the brazen nature of IRIS C2’s recruitment—combining million-dollar promises with a lack of transparency regarding its leadership’s criminal history—contrasts with the circumspect nature of legitimate government contractors. Because Calvexa Group LLC appears to have no active government contracts despite its registration, the legitimacy of Wohl’s claims regarding federal work remains unverified.