Companies that agree to hand over cash to hackers to free their systems from ransomware may face prosecution or penalties, the US Treasury said on Thursday.
Advisories from both the Treasury's Office of Foreign Assets Control (OFAC) and its Financial Crimes Enforcement Network (FinCEN) have warned that many hacker groups are believed to be operating from countries under economic sanctions, as reported by Reuters.
Any companies engaging with groups inside these countries could be in breach of these sanctions, the advisories warned, even in those cases where the company was unaware of the hackers' location.
The OFAC's advisory cited cyber attacks that were linked to hacking groups from North Korea and Russia, which are both nations sanctioned by the US. The US government often imposes economic and trade sanctions on countries that it deems sponsors terrorism or that violate human rights.
These latest warnings from the OFAC and FinCEN show an intent to regulate a rapidly growing market of companies who help organisations pay off hackers, such as cyber insurance firms or security consultancies.
The Enforcement Network's advisory also warned that cyber security firms may need to register as 'money services' if they help make these ransomware payments. This would place a new requirement on a section of the cyber security industry that is rapidly growing.
An affected company's decision to pay a ransom is not necessarily illegal, though it is usually ill advised. A 2019 survey from AT&T Cybersecurity revealed that 40% of IT security professionals believe that there should be a law preventing firms from paying ransoms. The argument often centres on the problem of there being no guarantee that the hackers will fulfil their end of the bargain and return stolen data.
-
Everything we know about the Plex data breach so farNews Plex advised users to sign out of any connected devices that are currently logged in and enable two-factor authentication if they haven’t already.
-
Mainframes are back in vogueNews Mainframes are back in vogue, according to research from Kyndryl, with enterprises ramping up hybrid IT strategies and generative AI adoption.
-
Prolific ransomware operator added to Europe’s Most Wanted list as US dangles $10 million rewardNews The US Department of Justice is offering a reward of up to $10 million for information leading to the arrest of Volodymyr Viktorovych Tymoshchuk, an alleged ransomware criminal.
-
Jaguar Land Rover “did the right thing” shutting down systems to thwart cyber attackNews The attack on Jaguar Land Rover highlights the growing attractiveness of the automotive sector
-
Ransomware attack on IT supplier disrupts hundreds of Swedish municipalitiesNews The attack on IT systems supplier Miljödata has impacted public sector services across the country
-
A notorious hacker group is ramping up cloud-based ransomware attacksNews The Storm-0501 threat group is refining its tactics, according to Microsoft, shifting away from traditional endpoint-based attacks and toward cloud-based ransomware.
-
Security researchers have just identified what could be the first ‘AI-powered’ ransomware strain – and it uses OpenAI’s gpt-oss-20b modelNews Using OpenAI's gpt-oss:20b model, ‘PromptLock’ generates malicious Lua scripts via the Ollama API.
-
Data I/O shuts down systems in wake of ransomware attack
News Regulatory filings by Data I/O suggest the costs of dealing with the attack could be significant
-
Average ransom payment doubles in a single quarterNews Targeted social engineering and data exfiltration have become the biggest tactics as three major ransomware groups dominate
-
BlackSuit ransomware gang taken down in latest law enforcement sting – but members have already formed a new groupNews The notorious gang has seen its servers taken down and bitcoin seized, but may have morphed into a new group called Chaos
