Advancing UK Aerospace, Defence, Security & Space Solutions Worldwide
  • Home
  • /
  • Security
  • /
  • Russian ransomware group hit with new sanctions

Security

Russian ransomware group hit with new sanctions

A further eleven members of the prolific Conti/Trickbot ransomware group have been exposed and sanctioned by the UK and US, as part of a joint campaign targeting international cyber criminals.

Image courtesy NCA

The US Department of Justice is concurrently unsealing indictments against nine individuals in connection with the Trickbot malware conspiracy and Conti ransomware conspiracy, including seven of the individuals designated today.

Investigations by the NCA and FBI identified that these men, all Russian nationals, were influential members of the group, working as developers, administrators who facilitated payments to the group from ransom funds, and managers who recruited new members from cyber crime forums.

Advertisement
Cranfield

Sanctioned Cyber BlogThe NCA assesses that the group was responsible for extorting at at least £27 million from 149 UK victims. Research by Chainalysis shows that the crime group is responsible for at least $800 million of extortion attacks globally.

The attackers sought to target UK hospitals, schools, local authorities and businesses.

Today’s sanctions have been brought by the FCDO and the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) and are the latest round of designations following the first ever joint UK-US sanctions against seven members of the same group in February this year.

NCA Director General of Operations Rob Jones said: “These sanctions are a continuation of our campaign against international cyber criminals.

“Attacks by this ransomware group have caused significant damage to our businesses and ruined livelihoods, with victims having to deal with the prolonged impact of financial and data losses.

“These criminals thought they were untouchable, but our message is clear: we know who you are and, working with our partners, we will not stop in our efforts to bring you to justice.”

All 18 of these cyber criminals are now subject to travel bans and asset freezes and are severely restricted in their use of the legitimate global financial system.

Assessment and industry reporting show that sanctions have disrupted ransomware operations, including hampering the ability of threat actors to monetise their criminal activities.

As well as disrupting the activities of ransomware criminals via sanctions, the NCA has been working with international partners to target the tools and services that underpin their offending.

Last week, the NCA supported the FBI and DoJ in the takedown of Qakbot malware, which facilitated ransomware attacks and caused millions of pounds worth of damage worldwide.

Over a period of 16 years, Qakbot was used by the Conti group, as well as the criminals behind the ProLock, Egregor, REvil and Black Basta ransomware strains, to steal personal data including banking credentials, from victims.

Although the Conti group disbanded last year, reporting suggests its members, including those sanctioned today, continue to be involved in some of the most notorious new ransomware strains that dominate and threaten UK security.

The group was also one of the first to offer support for Russia’s invasion of Ukraine and key group members highly likely maintain links to the Russian Intelligence Services from whom they have likely received tasking.

Foreign Secretary James Cleverly said: “These cyber-criminals thrive off anonymity, moving in the shadows of the internet to cause maximum damage and extort money from their victims.

“Our sanctions show they cannot act with impunity. We know who they are and what they are doing.

“By exposing their identities, we are dismantling their business models, making it harder for them to target our people, our businesses and our institutions.”

Security Minister Tom Tugendhat said: “These sanctions demonstrate that the UK will crackdown on those trying to hold UK businesses and infrastructure to ransom. We will use our law enforcement agencies to go after the perpetrators and punish their crimes.

“We have the skills and resources to find and unmask criminals who attempt to steal from British businesses, schools and hospitals.

Advertisement
Cranfield

“We will keep working with our partners, like the US, to defeat these threats.”

NCSC CEO Lindy Cameron said: “Alongside this latest round of sanctions, I strongly encourage organisations to proactively obstruct the activities of ransomware operatives by bolstering their online resilience.

“Ransomware continues to be a significant threat facing the UK and attacks can have significant and far-reaching impact.

“The NCSC has published free and actionable advice for organisations of all sizes on how to put robust defences in place to protect their networks.”

The individuals being designated in the UK and US today are:

  • Andrey Zhuykov was a central actor in the group and a senior administrator. Known by the online monikers “Defender”, “Dif” and “Adam”.
  • Maksim Galochkin led a group of testers, with responsibilities for development, supervision and implementation of tests. Known by the online monikers “Bentley”, “Volhvb” and “Max17”
  • Maksim Rudenskiy was a key member of the Trickbot group and was the team lead for coders. Known by the online monikers “Buza”, “Silver” and “Binman”.
  • Mikhail Tsarev was a mid-level manager who assisted with the group's finances and overseeing of HR functions. Known by the online monikers “Mango”, “Frances” and “Khano”.
  • Dmitry Putilin was associated with the purchase of Trickbot infrastructure. Known by the online monikers “Grad” and “Staff”.
  • Maksim Khaliullin was an HR manager for the group. He was associated with the purchase of Trickbot infrastructure including procuring Virtual Private Servers (VPS). Known by the online moniker “Kagas”.
  • Sergey Loguntsov was a developer for the group. Known by the online monikers “Begemot”, “Begemot_Sun” and “Zulas”.
  • Alexander Mozhaev was part of the admin team responsible for general administration duties. Known by the online monikers “Green” and “Rocco”.
  • Vadym Valiakhmetov worked as a coder and his duties included backdoor and loader projects. Known by the online monikers “Weldon”, “Mentos” and “Vasm”.
  • Artem Kurov worked as a coder with development duties in the Trickbot group. Known by the online moniker “Naned”.
  • Mikhail Chernov was part of the internal utilities group. Known by the online monikers “Bullet” and “m2686”.

Guidance for ransomware victims
If you are the victim of a ransomware attack, you should use the UK Government’s Cyber Incident Signposting Site as soon as possible for direction on which agencies to report your incident to.

The Office of Financial Sanctions Implementation has published guidance, which sets out the implications of sanctions in ransomware cases.

Making funds available to the individuals such as paying ransomware, including in cryptoassets, is prohibited under these sanctions.

Organisations should have or should put in place robust cyber security and incident management systems in place to prevent and manage serious cyber incidents.

 

 

 

Advertisement
L3Harris LB May IR L3Harris LB May IR
Adarga acquires J2X Solutions

Defence Security

Adarga acquires J2X Solutions

13 June 2024

London headquartered AI software specialist Adarga, today announced the acquisition of US strategic risk intelligence firm, J2X Solutions.

G3 Systems refurbs British Army’s TCDA

Defence Security

G3 Systems refurbs British Army’s TCDA

13 June 2024

G3 Systems has announced a rolling refurbishment programme, contracted by the UK MoD’s Defence Equipment and Support (DE&S) agency, to extend the working life of their operationally proven and highly acclaimed Tactical Containerised Dog Accommodation (TCDA) for use by 1st Military Working Dogs (MWD) Regiment, based at St Georges Barracks, North ...

Airports criticise Government over liquids restrictions announcement

Aerospace Security

Airports criticise Government over liquids restrictions announcement

13 June 2024

Over the weekend, the UK's Department for Transport (DfT) announced that from 00:01 on Sunday 9th June 2024, 100ml restrictions on liquids will temporarily be reintroduced at UK airports.

Base Materials boosts subsea buoyancy options

Defence Security

Base Materials boosts subsea buoyancy options

12 June 2024

Leicester headquartered Base Materials has launched a new buoyancy repair and refurbishment service providing remotely operated vehicle (ROV) owners and operators with a more sustainable alternative to purchasing new buoyancy modules.

Advertisement
ODU RT 2
Kromek presenting D5 RIID at Eurosatory 2024

Defence Security Events

Kromek presenting D5 RIID at Eurosatory 2024

12 June 2024

Sedgefield based radiation and biological detection company Kromek, will focus on the latest evolution of its D5 RIID at Eurosatory next week (17th-21st June), which can now be mounted onto any unattended UGV platform.

Hughes Europe expands into defence and government sectors

Defence Security Space

Hughes Europe expands into defence and government sectors

12 June 2024

Hughes Europe has announced its strategic expansion into the military, defence and government sectors across pan-European nations, with launch of Konnect VHTS Services in collaboration with Telespazio.

Advertisement
SPX Comms