Paying ransomware demands may breach international sanctions, US Treasury warns
Advisories warn that it's illegal to engage with entities inside countries under economic sanctions
Companies that agree to hand over cash to hackers to free their systems from ransomware may face prosecution or penalties, the US Treasury said on Thursday.
Advisories from both the Treasury's Office of Foreign Assets Control (OFAC) and its Financial Crimes Enforcement Network (FinCEN) have warned that many hacker groups are believed to be operating from countries under economic sanctions, as reported by Reuters.
Any companies engaging with groups inside these countries could be in breach of these sanctions, the advisories warned, even in those cases where the company was unaware of the hackers' location.
The OFAC's advisory cited cyber attacks that were linked to hacking groups from North Korea and Russia, which are both nations sanctioned by the US. The US government often imposes economic and trade sanctions on countries that it deems sponsors terrorism or that violate human rights.
These latest warnings from the OFAC and FinCEN show an intent to regulate a rapidly growing market of companies who help organisations pay off hackers, such as cyber insurance firms or security consultancies.
The Enforcement Network's advisory also warned that cyber security firms may need to register as 'money services' if they help make these ransomware payments. This would place a new requirement on a section of the cyber security industry that is rapidly growing.
An affected company's decision to pay a ransom is not necessarily illegal, though it is usually ill advised. A 2019 survey from AT&T Cybersecurity revealed that 40% of IT security professionals believe that there should be a law preventing firms from paying ransoms. The argument often centres on the problem of there being no guarantee that the hackers will fulfil their end of the bargain and return stolen data.
-
The UK is running on fumes as data center build-outs can’t keep pace with demandNews The country's vacancy rate has dropped sharply, with much of the pipeline early-stage and uncertain
-
Developers urged to remain vigilant amid continued Miasma malware risksNews The Miasma malware package uses legitimate OIDC tokens, making it indistinguishable from routine code updates
-
Ransomware cartels are fragmenting into volatile splinter groups, warns Met Police cyber chiefNews Commoditized "cyber crime bazaars" and AI data mining are forcing law enforcement to rewrite its playbook
-
New ransomware threat group, The Gentlemen, has become one of the most active ransomware operators, accounting for 10% of all attacksNews NTT researchers warn that the RaaS group is leveraging SystemBC malware to establish covert tunnelling, evade detection, and support rapid lateral movement across enterprise environments
-
Instructure chose to a pay ransom following the Canvas cyber attack – research shows more than half of security leaders would follow suitAnalysis Opting to pay ransoms creates huge risks for enterprises – you’re relying on the word of criminals
-
Ransomware negotiator sentenced for role in major cyber crime groupNews Deniss Zolotarjovs was a key player in a group associated with Conti
-
Threat actors ditch ‘spray and pray’ attacks in shift to targeted exploitationNews A dip in ransomware volumes points to a more targeted approach focused on vulnerability exploitation
-
Security leaders overconfident about ransomware recovery
News Few manage to recover all their data, and many experience business disruption
-
German authorities want your help finding the hackers behind GandCrab and REvilNews Daniil Maksimovich Shchukin and Anatoly Sergeevitsch Kravchuk are believed to have made millions from ransomware as a service schemes
-
The rise of teen hackers ‘makes for a good headline’, but cyber crime activities peak later in life
News With family responsibilities and mortgages to pay, it's not teenagers dishing out malware or carrying out cyber extortion
