red 
On September 7, 2023, the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) – in coordination with the United Kingdom – sanctioned 11 administrators, managers, developers and coders who allegedly provided assistance to the Russian cybercriminal organization Trickbot. This action follows previous sanctions against the group, which were announced in February 2023.
The malware he developed was used to attack millions of victim computers around the world. OFAC’s focus on Russian-based cybercrime groups, including Trickbot, follows the latter’s targeting of the US government, along with critical infrastructure and healthcare facilities in the United States and the UK – particularly during the Covid-19 pandemic.
Discussing today’s sanctions, Rob Jones – Director of Operations at the UK’s National Crime Agency (NCA) – said: “This ransomware group’s attacks have caused significant damage to our businesses and destroyed livelihoods, with victims having to deal with the long-term impact of financial and data losses.”
Expanding the network
In its press release, OFAC noted that in addition to these sanctions, the US Department of Justice (DoJ) is unsealing indictments against nine individuals in connection with the Trickbot malware and Conti ransomware schemes, including the seven individuals designated today.
Research previously conducted by AdvIntel found that by 2021, the Conti ransomware group was the sole user of the Trickbot malware. The Russian-based cybercriminal organization is one of the most notorious ransomware gangs in recent years.
Details of the nature of Conti’s internal operations were revealed in February 2022, when activists released approximately 60,000 internal conversations in retaliation for the group declaring support for Russia’s invasion of Ukraine. Many of the individuals sanctioned in today’s announcement appear in these leaked chats.
Elliptic’s analysis of the crypto addresses associated with these sanctioned individuals shows that they have received nearly $1 million from various activities, including their association with the Conti ransomware gang.
The full OFAC press release can be found here.
How we can help
Elliptic has taken immediate action to flag the new sanctioned addresses in our systems. Our clients will now be able to review and be alerted to any activity related to these addresses. Check out our transaction tracking and verification tools to learn more or contact us for a demo.
You can also read our recently updated Cryptocurrency Sanctions Compliance for case studies and examples of how to use blockchain analytics for OFAC compliance.
