MCLEAN, VA. — IRIS C2, a company located in McLean, Va., states it sells offensive cybersecurity capabilities. Jacob Wohl, an associate of Jack Burkman, stated that IRIS C2 shifted its focus recently to selling phone-hacking services to the government.

Wohl stated that IRIS C2 originally began as a penetration testing company. He added that Burkman is not involved in the day-to-day operations of IRIS C2. The company's X/Twitter account, created in January 2025, has gained more than 4,000 followers.

A pinned post on the IRIS C2 X account states: "Our business model is this. Attract the very best vulnerability researchers and exploit developers in the world to join our company. This mostly revolves around junior engineers with raw talent/extremely high IQ. We don't care if they have a college degree/industry experience." The company's website also indicates it is hiring for open positions.

The IRIS C2 website states the company acquires zero-day exploits, individual primitives, partial chains, and full capabilities across all major platforms. Payouts for these acquisitions can range from $10,000 to $7 million depending on target, reliability, and operational value. Wohl said security researchers bring the company unique vulnerability findings on a regular basis.

Wohl stated that in many cases vulnerability findings received are preliminary and not fully fleshed-out. He said IRIS C2 enhances these initial findings to create stable and reliable exploits. "Let's say someone finds a flaw in a media decoder on a phone," Wohl said. "A lot of times what we receive is an exploit primitive, where the idea is there but the [execution] needs work. You need that exploit to be stable and reliable, and that's what we do."

The government contracting portal g2exchange.com reports that irisc2.com is operated by Calvexa Group LLC, a business based in Virginia. G2Exchange shows Calvexa Group LLC is registered as a federal contractor, though it does not appear to be working on any direct government contracts. The contact link on the Calvexa Group website forwards visitors to irisc2.com. Incorporation records for Calvexa Group LLC list an address in Arlington, Va.

Wohl claims IRIS C2 has approximately 40 employees. He stated that employees are not allowed to list their employment on LinkedIn for operational security reasons. Wohl stated he does not have any formal education or training in computer science or information security, adding that most of his knowledge in these areas is self-taught.