The US Treasury Department has announced its first sanctions against a cryptocurrency exchange, the Russia-linked Suex, for facilitating ransom transactions for ransomware gangs and helping them evade sanctions.
See also: Marketron: BlackMatter ransomware targeted software provider
Suex is registered in the Czech Republic but has no physical presence there. Instead, it operates out of branches in Moscow and St. Petersburg and other locations in Russia and the Middle East, according to Chainalysis.
“SUEX facilitated transactions involving illicit proceeds from at least eight ransomware variants. Analysis of known SUEX transactions indicates that over 40% of SUEX’s known transaction history is related to illicit actors,” the Treasury Department said today.
“This action is the first sanction against a virtual currency exchange and was carried out with the assistance of the Federal Bureau of Investigation.”.
This move is designed to disrupt the main channel used by ransomware operations to collect ransoms from their victims, which, the Treasury Department added, amounted to over $400 million last year.
See also: BlackMatter ransomware: Demands 5.9 million from agricultural cooperative
By imposing sanctions on crypto exchanges that provide ransomware groups with material support, the US hopes to disrupt their activities.
The Office of Foreign Assets Control (OFAC) also issued an advisory today highlighting the “sanctions risks associated with ransomware payments in connection with malicious cyber activities.”.
As Chainalysis revealed today, Suex has received more than $481 million in Bitcoin since it began operating – in February 2018 – including funds obtained from cybercriminals:
- Nearly $13 million from ransomware operators including Ryuk, Conti, Maze and several others
- Over $24 million from cryptocurrency scam operators, including the fraudsters behind Finiko, a scam that extracted over $1 billion worth of cryptocurrency from victims primarily in Russia and Ukraine
- Over $20 million from darknet purchases, mainly from Russia-based Hydra Market
Part of a larger effort to disrupt ransomware operations
The Biden administration is expected to issue sanctions this week against cryptocurrency exchanges, wallets and merchants used by ransomware groups, the Wall Street Journal reported on Friday.
These are not the first sanctions the US government has imposed on entities or threat actors associated with ransomware gangs.
In 2019, the US accused members of Evil Corp of stealing over $100 million and they were added to the Office of Foreign Assets Control (OFAC) sanctions list.
See also: Windows MSHTML bug: Ransomware groups exploit the flaw
Over the years, Evil Corp has been linked to several ransomware families, including WastedLocker, Hades, Phoenix CryptoLocker, and PayLoadBin.
In October, the Treasury Department also warned that ransomware negotiators could face civil penalties for facilitating ransom payments to ransomware gangs on the sanctions list.
Information source: bleepingcomputer.com
