September 2021 OFAC Updated Advisory: Sanctions against Russian Crypto Exchange, Strongly worded Warnings
As expected and announced by inside sources (See our earlier article here) the US Department of Treasury has published an updated Advisory on Ransomware (). Reiterating the danger that ransomware possess for the national security of the US, the advisory reads:
Facilitating a ransomware payment that is demanded as a result of malicious cyber activities may enable criminals and adversaries with a sanctions nexus to profit and advance their illicit aims.
For example, ransomware payments made to sanctioned persons or to comprehensively
sanctioned jurisdictions could be used to fund activities adverse to the national security and
foreign policy objectives of the United States. Such payments not only encourage and enrich
malicious actors, but also perpetuate and incentivize additional attacks. Moreover, there is no
guarantee that companies will regain access to their data or be free from further attacks
themselves. For these reasons, the U.S. government strongly discourages the payment of cyber
ransom or extortion demands.
In addition to guidelines for US businesses and strongly worded warnings for any US citizen to engage in transactions with sanctioned entities, even if these transactions happen unknowingly, the advisory in particular added the Russian crypto exch iange SUEX to its list of sanctioned entities.
In September 2021, OFAC designated SUEX OTC, S.R.O. (“SUEX”), a virtual currency
exchange, for its part in facilitating financial transactions for ransomware actors, involving illicit
proceeds from at least eight ransomware variants. Analysis of known SUEX transactions
showed that over 40% of SUEX’s known transaction history was associated with illicit actors.10
OFAC has imposed, and will continue to impose, sanctions on these actors and others who
materially assist, sponsor, or provide financial, material, or technological support for these
activities.
While it is of course too early to say how effective these measures will turn out to be, the cyber insurance ecosystem will closely watch the regulatory developments in the still by far most important market.
References
Daniel Kasper
Daniel Kasper is the principal of Cyber Economics.
