From Political Operatives to Cyber-Brokers: The Troubling Rise of IRIS C2

In the high-stakes, shadow-filled world of offensive cybersecurity, reputation is the primary currency. Government agencies and defense contractors typically source "zero-day" vulnerabilities—undisclosed software flaws that allow for remote device exploitation—through vetted, highly secretive, and professionalized channels. However, a new player has emerged in McLean, Virginia, that is shattering the industry’s norms of discretion.

IRIS C2, a cybersecurity startup promising payouts of up to $7 million for elite exploit development, is rapidly gaining traction on social media. But behind the sophisticated marketing and promises of "exquisite capabilities" lies a duo better known for courtroom drama than code: Jack Burkman and Jacob Wohl. The pair, whose resume includes a long history of felony convictions, fraudulent intelligence schemes, and state-sanctioned fines, are now positioning themselves as the new gatekeepers of the global exploit market.

The IRIS C2 Operation: A Blueprint for Risk

Since its inception in January 2025, the X account @C2IRIS has amassed over 4,000 followers, positioning itself as a hub for vulnerability research. The company’s business model is explicitly predatory: it targets "junior engineers with raw talent," explicitly stating that degrees and industry experience are irrelevant.

According to its website, irisc2[.]com, the firm acts as a broker for offensive security assets, including full-chain exploits and partial primitives. While the offer of multi-million dollar payouts is designed to attract top-tier talent, industry experts are baffled by the brazenness of the operation. Unlike the traditional, quiet acquisition of exploits, IRIS C2 conducts its recruitment with the bombast of a political campaign, raising significant questions about the legitimacy of its claims and the safety of the researchers who engage with it.

Government contracting records linked to the entity reveal that IRIS C2 is operated under the umbrella of Calvexa Group LLC. Despite being registered as a federal contractor, there is no public record of the company fulfilling any direct government contracts, casting doubt on whether IRIS C2 is a functional security firm or merely the latest iteration of the pair’s long history of "fake-it-till-you-make-it" ventures.

A History of Deception: The Wohl-Burkman Chronology

To understand the skepticism surrounding IRIS C2, one must look at the track record of its principals. The partnership between the 60-year-old Burkman and the 28-year-old Wohl has been characterized by a relentless drive to manufacture controversy for profit and political theater.

The Early Years: The "Wohl of Wall Street"

Jacob Wohl first gained notoriety as a teenager, branding himself "Wohl of Wall Street" and appearing on mainstream news outlets as a hedge fund prodigy. This image collapsed in 2017 when the Arizona Corporation Commission charged him with 14 counts of securities fraud. By 2019, he had pleaded guilty in California to felony charges related to the sale of unregistered securities, serving two years of probation.

The Era of Manufactured Intelligence

Following his departure from finance, Wohl joined forces with Burkman to launch a series of "intelligence" firms. These entities were used as vehicles to spread disinformation. They were responsible for:

• Fabricated Scandals: In 2018 and 2019, they staged elaborate, failed press conferences alleging sexual misconduct by figures such as former FBI Director Robert Mueller and then-Mayor Pete Buttigieg.
• Political Interference: They targeted Senator Elizabeth Warren and Kamala Harris with similar, unsubstantiated claims of extramarital affairs, which were debunked almost immediately by the media.

The Robocall Prosecution

The pair’s most significant legal reckoning occurred in the wake of the 2020 presidential election. They were indicted on multiple felony counts for orchestrating massive robocall campaigns in battleground states, designed to suppress voter turnout in Black communities. The fallout was severe:

• 2022: Both pleaded guilty to felony telecommunications fraud in Ohio.
• 2023: The FCC imposed a $5.1 million fine against them—the largest in the history of the Telephone Consumer Protection Act.
• 2025: After exhausted appeals, they were sentenced to probation for their roles in the voter suppression scheme.

The AI-Lobbying Mirage

As recently as 2024, the duo operated "LobbyMatic," an AI-based lobbying platform. Investigative reporting by Politico revealed that they operated the company under aliases—Wohl as "Jay Klein" and Burkman as "Bill Sanders." Employees resigned in droves upon discovering the true identities of their bosses, marking another chapter of professional deception.

Supporting Data: The Digital Footprint

The current structure of IRIS C2 mirrors the architecture of their previous failed ventures. The address provided in incorporation documents for Calvexa Group LLC leads directly to the offices of Burkman & Associates in Arlington, Virginia. When confronted with questions regarding the nature of IRIS C2, Burkman consistently deflects, redirecting inquiries to Wohl.

The technical claims made by the company are equally suspect. Wohl, who possesses no formal computer science education, has claimed in interviews to have "exquisite" technical knowledge. However, public GitHub repositories associated with him do not reflect the level of sophistication required for the high-end exploit development he purports to facilitate.

Furthermore, recent reports have highlighted that the pair has been active in illicit circles. Journalist Molly White reported that in 2026, the duo was hired on a $300,000 retainer by a Canadian cryptocurrency fraudster—wanted for the theft of $65 million—to lobby for a presidential pardon. This suggests that the "offensive security" business may be a secondary front for a wider variety of questionable legal and consulting services.

Official Responses and Industry Skepticism

The cybersecurity community has reacted to IRIS C2 with a mixture of amusement and alarm. Legitimate firms in the vulnerability acquisition market—companies that perform rigorous background checks and operate within the bounds of international law—are concerned that IRIS C2’s erratic behavior could attract unwanted regulatory scrutiny or jeopardize the safety of researchers.

When interviewed by KrebsOnSecurity, Wohl claimed that IRIS C2 has a staff of 40 people. However, he admitted that none of them list their employment on LinkedIn for "operational security reasons." This secrecy is common in the intelligence community but highly unusual for a startup seeking to recruit talent through open social media posts. Wohl’s insistence that he is a self-taught technical genius, capable of creating capabilities that would "make your head spin," contrasts sharply with his documented history of administrative and legal failure.

Implications: The Risks of "Wild West" Cybersecurity

The emergence of IRIS C2 highlights a growing vulnerability in the digital security ecosystem. As the demand for zero-day exploits grows, the barrier to entry for brokers is effectively non-existent. When individuals with histories of felony fraud can establish themselves as "cybersecurity contractors," the potential for catastrophe is immense.

Potential Consequences:

1. Exploitation of Junior Researchers: Young, talented engineers lured by the promise of million-dollar payouts may find themselves working for a company that does not hold the necessary clearances or ethics to handle sensitive data, potentially putting them at legal risk.
2. National Security Risks: If IRIS C2 is indeed attempting to broker exploits to the government, there is a risk that these assets could be mishandled, leaked, or fall into the hands of foreign adversaries due to the firm’s lack of operational security and professional experience.
3. Market Corruption: By promising astronomical, likely unsustainable, payouts, IRIS C2 threatens to distort the market for vulnerability research, drawing talent away from reputable firms and into an environment that lacks accountability.

The story of IRIS C2 is a cautionary tale about the intersection of modern cyber-warfare and the era of "post-truth" political operative. While the firm presents itself as a cutting-edge security startup, the facts suggest a more familiar pattern: a calculated attempt to capitalize on a high-growth industry using the same tactics of obfuscation and deception that have landed its founders in courtrooms for the better part of a decade. For now, the cybersecurity world is watching closely, waiting to see if this venture will follow the same path as LobbyMatic—into irrelevance and disrepute.