A cybersecurity startup dangling thousands and thousands of {dollars} to amass zero-day safety vulnerabilities in well-liked software program is run by a pair of far-right conspiracy theorists and convicted felons whose most up-to-date ventures included pretend intelligence corporations and a now-defunct AI-based lobbying platform they operated underneath assumed names.
The X/Twitter account IRIS C2 (@C2IRIS) has gained greater than 4,000 followers since its creation in January 2025, posting often about safety vulnerabilities, AI and software program exploits. IRIS C2 says it’s a firm in McLean, Va. that sells offensive cybersecurity capabilities.
The IRIS C2 web site dangles the potential of million-dollar payouts for exploits to draw expertise.
“Our enterprise mannequin is that this,” reads a pinned publish on prime of the IRIS C2 account on X. “Appeal to the easiest vulnerability researchers and exploit builders on this planet to affix our firm. This principally revolves round junior engineers with uncooked expertise/extraordinarily excessive IQ. We don’t care if they’ve a university diploma/business expertise.”
The web site linked in that profile — irisc2[.]com — says the corporate is hiring for quite a few open positions, and a current publish on its LinkedIn web page enthuses about an awesome variety of functions from potential workers. The web site claims IRIS C2 is within the enterprise of buying “zero-day exploits, particular person primitives, partial chains, and full capabilities throughout all main platforms. Payouts vary from $10,000 to $7 million relying on course, reliability, and operational worth.”
The federal government contracting portal g2exchange.com experiences that irisc2[.]com is operated by a enterprise based mostly in Virginia known as Calvexa Group LLC. The “contact” hyperlink on the web site for Calvexa Group — calvexagroup[.]com — forwards guests to irisc2[.]com. G2Exchange reveals that whereas Calvexa Group LLC is registered as a federal contractor, it doesn’t look like engaged on any direct authorities contracts.
A search on the Arlington, Va. handle listed within the incorporation data for Calvexa Group LLC finds the property is occupied by Jack Burkman, the 60-year-old founder and managing companion of the lobbying agency Burkman & Associates. When approached with questions on IRIS C2, Burkman referred additional inquiries to his longtime affiliate, 28-year-old Jacob Wohl.
Jack Burkman (left) and Jacob Wohl, at a press convention in August 2020. Picture: Wikipedia.
Burkman and Wohl have a storied historical past of making pretend intelligence corporations and utilizing them to unfold false claims about and body public figures, together with fabricated sexual assault claims in opposition to then FBI director Robert Mueller, and Pete Buttigieg, then mayor of South Bend, Indiana and a Democratic candidate for the presidency. In 2019, Burkman and Wohl held press conferences falsely alleging extramarital affairs by Sen. Elizabeth Warren (D-Mass.) and then-2020 presidential candidate Kamala Harris.
Within the wake of the 2020 presidential election, Wohl and Burkman had been prosecuted by a number of U.S. states for making hundreds of robocalls to residents of battleground states and disseminating false claims about mail-in ballots. They had been indicted in Cleveland on 15 felony counts of orchestrating a robocall scheme geared toward suppressing the black vote in Detroit, and had been sentenced in late 2025 to probation after their appeals to dismiss the costs had been rejected.
In 2022, Wohl and Burkman each pleaded responsible to a single felony cost of telecommunications fraud in Ohio, and sentenced to a superb, probation, and neighborhood service. In March 2023, a choose in a New York civil case dominated that Wohl and Burkman had violated federal and state civil rights legal guidelines, and the 2 agreed to pay a $1 million settlement.
In June 2023, the Federal Communications Fee (FCC) imposed a $5.1 million superb in opposition to Wohl and Burkman for his or her robocall campaigns, on the time the most important superb ever sought by the FCC underneath the Phone Client Safety Act.
Jacob “Jay” Wohl’s GitHub account.
By the age of 17, Wohl had began a number of funding corporations, and cultivated the nickname “Wohl of Wall Road” after showing on Fox Information in 2015 to debate his new hedge funds. In 2017, the Arizona Company Fee charged Wohl and his funding funds with 14 counts of securities fraud, and ordered him to pay $35,000 in restitution. In 2019, Wohl pleaded responsible in California to 4 felony counts of promoting unregistered securities and was sentenced to 2 years of probation.
The marketplace for beforehand unknown safety vulnerabilities has at all times been populated by a colourful mixture of researchers, teachers, charlatans, clout-chasers and folks actively concerned in cybercrime communities. However the marketplace for promoting offensive safety providers to the U.S. authorities tends to be much more circumspect. Loads of authorities contractors recruit vulnerability researchers and pay for the unique rights to novel software program exploits, but none of them accomplish that fairly as overtly and brazenly as IRIS C2.
Current posts from the Twitter/X account IRISC2 (@c2iris).
Certainly, KrebsOnSecurity was unaware of IRIS C2 till final month, when an attendee at a regional cybersecurity convention shared that Wohl and Calvexa Group had been pestering individuals on the convention about promoting their vulnerability analysis.
In an interview with KrebsOnSecurity, Wohl stated Mr. Burkman was not concerned within the day-to-day operations of IRIS C2. Wohl shared that IRIS C2 initially started as a penetration testing firm, however shifted its focus lately to promoting phone-hacking providers to the federal government. A number of instances all through the interview, Mr. Wohl talked about engaged on federal authorities contracts, however when pressed for specifics stated he was not at liberty to talk publicly about them.
Mr. Wohl stated he doesn’t have any formal schooling or coaching in pc science or data safety, and that the majority of his data on the matter is self-taught.
“I do know extra about tech than anybody,” Wohl bragged. “My background has at all times been extraordinarily technical, and I’ve at all times been deeply into tech. Folks know me as somebody who is ready to create spectacularly beautiful capabilities that may make your head spin.”
Wohl stated safety researchers deliver the corporate distinctive vulnerability findings “regularly,” however that in lots of instances these findings are preliminary and never absolutely fleshed-out.
“Let’s say somebody finds a flaw in a media decoder on a telephone,” Wohl stated. “Plenty of instances what we obtain is an exploit primitive, the place the concept is there however the [execution] wants work. You want that exploit to be secure and dependable, and that’s what we do.”
Wohl claims IRIS C2 has roughly 40 workers, though he stated none of them are allowed to record their employment on LinkedIn for operational safety causes. In Might, the creator of the IRIS C2 account on X stated that his girlfriend had no concept what he did for a dwelling. But when IRIS C2 has some other workers, they might be equally unaware of Mr. Wohl’s historical past of outright fabrications — and even his actual title.
In September 2024, Politico reported that Burkman and Wohl had been bragging about large corporations supposedly shopping for providers from their now-defunct firm LobbyMatic, which claimed to make use of synthetic intelligence to help in political lobbying efforts. Nonetheless, Politico discovered the pair had been working the corporate utilizing pseudonyms, with Wohl reportedly adopting the title “Jay Klein” and Burkman utilizing the moniker “Invoice Sanders.” Politico reported that two of the previous LobbyMatic workers resigned after studying of their true identities, whereas different workers solely realized after they’d left the corporate.
