A cybersecurity startup, IRIS C2, that publicly advertises multi-million dollar payouts for zero-day security vulnerabilities in popular software, has been revealed to be operated by a pair of individuals with a documented history of promoting far-right conspiracy theories, engaging in fraudulent schemes, and accumulating multiple felony convictions. Jack Burkman, 60, and Jacob Wohl, 28, are the figures behind IRIS C2, a company that claims to be based in McLean, Virginia, and specializes in offensive cybersecurity capabilities. Their most recent ventures prior to IRIS C2 included orchestrating fake intelligence operations and an AI-based lobbying platform, LobbyMatic, which they ran under assumed names. The revelation casts a shadow of skepticism over IRIS C2’s legitimacy and raises serious questions about its operational ethics, given the sensitive nature of the zero-day exploit market.
IRIS C2: Public Face and Bold Claims
The public face of IRIS C2 is its X/Twitter account, @C2IRIS, which has garnered over 4,000 followers since its inception in January 2025. This account frequently posts about security vulnerabilities, artificial intelligence, and software exploits, positioning IRIS C2 as a key player in the offensive cybersecurity space. The company’s business model, as articulated in a pinned post on its X account, is to "Attract the very best vulnerability researchers and exploit developers in the world to join our company. This mostly revolves around junior engineers with raw talent/extremely high IQ. We don’t care if they have a college degree/industry experience."
The website linked in their profile, irisc2[.]com, reinforces these claims, actively recruiting for various open positions. Recent posts on its LinkedIn page boast of an "overwhelming number of applications" from potential employees, suggesting a robust interest in their offers. IRIS C2 explicitly states its objective to acquire "zero-day exploits, individual primitives, partial chains, and full capabilities across all major platforms," promising substantial payouts ranging from $10,000 to an astounding $7 million. These figures, they claim, are determined by the target’s criticality, the exploit’s reliability, and its overall operational value. The visual representation of these potential earnings, displayed prominently on their website, serves as a powerful lure for aspiring and experienced vulnerability researchers alike.
Further investigation into the company’s structure reveals that irisc2[.]com is operated by Calvexa Group LLC, a business registered in Virginia. This connection was identified through the government contracting portal g2exchange.com, which lists Calvexa Group LLC as the operator. Curiously, the "contact" link on Calvexa Group’s own website, calvexagroup[.]com, redirects visitors directly to irisc2[.]com, solidifying the link between the two entities. While Calvexa Group LLC is registered as a federal contractor, g2exchange.com indicates no active direct government contracts, which contrasts with later claims made by Wohl regarding government work.
The Troubling History of Jack Burkman and Jacob Wohl
The individuals at the helm of IRIS C2, Jack Burkman and Jacob Wohl, are far from newcomers to public scrutiny. A search of the Arlington, Virginia, address listed in the incorporation records for Calvexa Group LLC leads directly to a property occupied by Jack Burkman, the 60-year-old founder and managing partner of the lobbying firm Burkman & Associates. When questioned about IRIS C2, Burkman deferred all inquiries to his longtime associate, 28-year-old Jacob Wohl. Their combined history paints a vivid picture of a career built on controversy, misinformation, and legal challenges.
Jacob Wohl’s Early Forays into Finance and Fraud:
Before his entanglement with cybersecurity, Jacob Wohl cultivated an image as a financial prodigy, earning the moniker "Wohl of Wall Street." By the age of 17, he had already launched multiple investment firms, even making an appearance on Fox News in 2015 to discuss his hedge funds. However, this early success was quickly overshadowed by accusations of fraud. In 2017, the Arizona Corporation Commission charged Wohl and his investment funds with 14 counts of securities fraud, ordering him to pay $35,000 in restitution. This was followed by a 2019 conviction in California, where Wohl pleaded guilty to four felony counts of selling unregistered securities, resulting in a two-year probation sentence. These early financial misdeeds established a pattern of questionable business practices and legal skirmishes that would define much of his public career.
A Partnership in Deception: Burkman and Wohl’s Conspiracy Ventures:
The collaboration between Burkman and Wohl truly began to garner national attention through a series of elaborate and often bizarre hoaxes and conspiracy theories. Their modus operandi frequently involved creating fake intelligence companies to lend an air of legitimacy to their fabricated claims.
- Targeting Public Figures: Their targets were often high-profile political figures. In a particularly egregious example, they concocted fabricated sexual assault claims against then-FBI Director Robert Mueller during the height of the Russia investigation. They also aimed similar false accusations at Pete Buttigieg, then mayor of South Bend, Indiana, and a Democratic presidential candidate.
- False Allegations of Extramarital Affairs: In 2019, Burkman and Wohl held press conferences to spread false allegations of extramarital affairs against prominent Democratic politicians, including Senator Elizabeth Warren (D-Mass.) and then-2020 presidential candidate Kamala Harris. These events were widely debunked and ridiculed, further cementing their reputation as purveyors of disinformation. Their tactics often involved enticing individuals with financial incentives to make false statements, only for these schemes to unravel under scrutiny.
The Robocall Schemes and Extensive Legal Repercussions:
The most severe legal consequences for Burkman and Wohl stemmed from their activities surrounding the 2020 U.S. presidential election. In an effort to influence the election outcome, they orchestrated a massive robocall campaign targeting residents in battleground states, particularly in predominantly Black communities.
- Vote Suppression Efforts: Following the 2020 election, Wohl and Burkman were prosecuted by multiple U.S. states for making thousands of robocalls that disseminated false claims about mail-in ballots. A key aim of these calls was to suppress the Black vote in Detroit, a critical demographic in Michigan.
- Indictments and Sentencing: In Cleveland, Ohio, they were indicted on a staggering 15 felony counts for orchestrating this robocall scheme. After their appeals to dismiss the charges were rejected, they were sentenced in late 2025 to probation. This marked a significant legal defeat, highlighting the serious criminal nature of their activities.
- Plea Deals and Civil Penalties: In 2022, both Wohl and Burkman pleaded guilty to a single felony charge of telecommunications fraud in Ohio. Their sentence included a fine, probation, and community service, underscoring the ongoing legal fallout from their actions. The repercussions extended beyond criminal courts. In March 2023, a judge in a New York civil case ruled that Burkman and Wohl had violated federal and state civil rights laws through their robocall campaigns. They subsequently agreed to pay a substantial $1 million settlement.
- FCC Fine: The financial penalties continued to mount. In June 2023, the Federal Communications Commission (FCC) imposed a colossal $5.1 million fine against Wohl and Burkman for their illicit robocall campaigns. At the time, this represented the largest fine ever sought by the FCC under the Telephone Consumer Protection Act, emphasizing the unprecedented scale and impact of their unlawful activities.
LobbyMatic: Operating Under Pseudonyms:
Even amidst their mounting legal troubles, Burkman and Wohl continued their pattern of deceptive ventures. In September 2024, Politico reported on their now-defunct company, LobbyMatic, which purported to use artificial intelligence to assist in political lobbying efforts. The investigation revealed that the pair were operating LobbyMatic using pseudonyms: Wohl adopted the name "Jay Klein," while Burkman went by "Bill Sanders." This strategy was seemingly designed to obscure their identities from employees and potential clients. Politico’s report highlighted that two former LobbyMatic employees resigned after discovering the true identities of their employers, while others only learned of the deception after leaving the company. This incident further illustrates their consistent use of misdirection and assumed identities to conduct their business.
IRIS C2’s Operational Model and Wohl’s Self-Proclaimed Expertise:
The cybersecurity market for previously undisclosed vulnerabilities, known as zero-days, is a complex and often opaque ecosystem. It is populated by a diverse group of individuals, from ethical researchers and academics to charlatans and those deeply embedded in cybercrime communities. However, the segment of this market that sells offensive security services to government entities typically operates with extreme circumspection. Most government contractors involved in this space recruit vulnerability researchers discreetly and acquire exclusive rights to novel exploits without the kind of brazen public advertising seen from IRIS C2. This open approach immediately raised red flags within the cybersecurity community.
KrebsOnSecurity became aware of IRIS C2 when an attendee at a regional cybersecurity conference reported that Wohl and Calvexa Group representatives were actively "pestering" individuals about selling their vulnerability research. This direct, public solicitation is highly unusual for a company operating in such a sensitive domain, particularly one that claims to work with federal government contracts.
In an interview with KrebsOnSecurity, Jacob Wohl provided further insights into IRIS C2’s operations, albeit with characteristic self-aggrandizement and evasiveness. Wohl stated that Jack Burkman was not involved in the day-to-day operations of IRIS C2, attempting to distance the company from Burkman’s direct association. Wohl explained that IRIS C2 initially began as a penetration testing company but had recently shifted its focus to "selling phone-hacking services to the government." Throughout the interview, Wohl repeatedly mentioned working on federal government contracts, yet when pressed for specifics, he claimed he was "not at liberty to speak publicly about them," a common tactic to avoid verifiable details.
Despite having no formal education or training in computer science or information security, Wohl proudly declared his expertise. "I know more about tech than anyone," Wohl boasted. "My background has always been extremely technical, and I’ve always been deeply into tech. People know me as someone who is able to create spectacularly exquisite capabilities that would make your head spin." This self-taught narrative, while not impossible in the tech world, stands in stark contrast to the professional credentials typically expected in high-stakes cybersecurity roles, especially those involving government contracts.
Wohl detailed IRIS C2’s process for acquiring vulnerabilities, stating that security researchers bring the company unique findings "on a regular basis." However, he noted that these findings are often preliminary. "Let’s say someone finds a flaw in a media decoder on a phone," Wohl explained. "A lot of times what we receive is an exploit primitive, where the idea is there but the [execution] needs work. You need that exploit to be stable and reliable, and that’s what we do." This description suggests IRIS C2 aims to refine raw vulnerability data into fully functional and reliable exploits.
Wohl claimed IRIS C2 employs approximately 40 individuals, but with a significant caveat: none of them are permitted to list their employment on LinkedIn due to "operational security reasons." This secrecy, combined with the founders’ history of operating under pseudonyms, raises concerns about transparency and the potential for employees to be unaware of the true identities and checkered pasts of their employers. A post from the IRIS C2 account on X in May further fueled these suspicions, with the author mentioning his girlfriend had no idea what he did for a living, implying a deeply concealed operational environment.
Broader Implications and Ethical Concerns:
The emergence of IRIS C2, led by individuals with such a notorious history, presents a unique and troubling intersection of disinformation, fraud, and the sensitive realm of national security cybersecurity.
- Risk to Researchers: The promise of multi-million dollar payouts might attract talented, but perhaps naive, junior engineers or researchers seeking a breakthrough. However, aligning with a company founded by convicted felons known for deception could severely damage a researcher’s reputation and potentially entangle them in future legal or ethical quandaries. The opaque nature of "operational security" could also leave employees vulnerable to being unwitting participants in questionable activities.
- Integrity of the Zero-Day Market: The zero-day exploit market is already fraught with ethical debates, given that these vulnerabilities can be used for both defensive and offensive purposes, by nation-states, law enforcement, and criminal organizations alike. The entry of operators with a history of exploiting public trust for personal gain or political manipulation introduces an unprecedented level of risk and diminishes the overall integrity of this critical sector.
- Government Contracting Concerns: While IRIS C2 claims to be involved in federal government contracts, the lack of verifiable direct contracts for Calvexa Group LLC, combined with the founders’ criminal records, raises significant questions about how such a company could secure or maintain clearances for sensitive work. The U.S. government typically has stringent vetting processes for contractors involved in national security, making Burkman and Wohl’s involvement highly improbable for legitimate, sensitive operations.
- Blurring Lines Between Cyber and Disinformation: The founders’ background in spreading false claims and engaging in political manipulation adds another layer of concern. A company specializing in offensive cyber capabilities, run by individuals who previously weaponized information, could potentially leverage their technical access for purposes beyond legitimate defense or intelligence, including further disinformation campaigns or political interference.
Latest Developments: Involvement with a Cryptocurrency Fraudster
The pattern of questionable associations for Burkman and Wohl continued to unfold. An update from a March 31 publication by journalist Molly White brought to light another concerning development. White reported that Burkman and Wohl were paid a substantial $300,000 retainer by a Canadian cryptocurrency fraudster. This individual is wanted by the United States and several other countries for allegedly stealing $65 million from the crypto platforms KyberSwap and Indexed Finance, though he has not yet been convicted. According to White’s report, the purpose of this retainer was for Burkman and Wohl to pursue a "presidential pardon to avert a miscarriage of justice" on behalf of the accused hacker.
This latest revelation further solidifies the founders’ willingness to engage in high-stakes, ethically dubious ventures, even extending to the realm of international criminal defense for individuals accused of massive financial fraud. It suggests that IRIS C2 might be just one facet of a broader network of operations designed to leverage influence, technical capabilities, or legal loopholes for controversial clients, underscoring the deep ethical quagmire surrounding their activities.
Conclusion:
The emergence of IRIS C2, a cybersecurity startup promising lucrative payouts for zero-day exploits, under the leadership of Jack Burkman and Jacob Wohl, is a deeply unsettling development within the cybersecurity landscape. Their extensive and documented history of fraud, conspiracy theories, and multiple felony convictions, coupled with their consistent use of deception and pseudonyms, casts severe doubt on the legitimacy and ethical foundation of IRIS C2. While the zero-day market is inherently complex, the public and brazen nature of IRIS C2’s recruitment, juxtaposed with the founders’ past, stands as an anomaly. It serves as a stark reminder for researchers and the wider cybersecurity community to exercise extreme caution and due diligence when engaging with entities that operate in the shadows, particularly when those shadows are cast by individuals with such a problematic and legally challenged past. The ongoing scrutiny of IRIS C2 and its controversial leadership is imperative to ensure transparency and accountability in a domain critical to national and global security.
