Security pros face sanctions if they help ransomware victims pay

The US government has issued new ransomware guidance, as well as an advisory alerting security companies who assist victims of ransomware attacks by facilitating payments to designated cyber criminals attackers that they face potential sanctions risks under American law.

The advisory – which can be read in full here – was issued by the Department of the Treasury’s Office of Foreign Assets Control (OFAC), contains a stark warning that financial institutions, cyber security insurance firms and companies involved in digital forensics and incident response risk violating OFAC regulations if they are found to have assisted in making a payment.

“This advisory highlights OFAC’s designations of malicious cyber actors and those who facilitate ransomware transactions under its cyber-related sanctions programme,” said the Treasury in a statement.

“It identifies US government resources for reporting ransomware attacks and provides information on the factors OFAC generally considers when determining an appropriate enforcement response to an apparent violation, such as the existence, nature, and adequacy of a sanctions compliance programme.

“The advisory also encourages financial institutions and other companies that engage with victims of ransomware attacks to report such attacks to and fully cooperate with law enforcement, as these will be considered significant mitigating factors.”

The alert applies to those who assist in making payments to ransomware operators who have previously been designated under OFAC’s cyber-related sanctions programme – although clearly to make a payment to an undesignated operator is also highly inadvisable.

OFAC-designated actors include Evgeniy Bogachev, the developer of Cryptolocker and other threats; the Iranian developers of SamSam; North Korea’s Lazarus advanced persistent threat (APT) group, which launched the devastating WannaCry attacks; and Russia’s Evil Corp, which was behind Dridex and WastedLocker, the leader of which was indicted in 2019.

Besides violating OFAC regulations, the advisory noted that facilitating a ransomware payment enabled cyber criminals to “profit and advance their illicit aims” and could potentially fund activities “adverse” to the US’ national security and foreign policy objectives, as well as emboldening them to attack other targets.

Edgard Capdevielle, CEO of Nozomi Networks, said ransomware attacks were increasing in volume and sophistication, and that to give in to them only fuelled the fire.

“We are seeing more instances where the public and private sector respond to the pressure and pay the ransom. In addition to this week’s OFAC advisory, Senators Warren and Wyden have both introduced separate bills that would hold corporate executives accountable if they fail to take cyber security seriously,” he said.

“Ransomware attacks and other cyber threats will continue to remain constant as our personal lives and business operations continue to digitalise. That’s why choosing to pay a ransom is too often a short-sighted response that could come at a high cost.  Research has shown that paying a ransom can double the cost of recovery.

“Building, maintaining and constantly improving an organisation’s cyber security program is always the best approach and there are certainly tools available today that provide cost effective solutions.”