Advancing UK Aerospace, Defence, Security & Space Solutions Worldwide
  • Home
  • /
  • Security
  • /
  • Russian ransomware group hit with new sanctions

Security

Russian ransomware group hit with new sanctions

A further eleven members of the prolific Conti/Trickbot ransomware group have been exposed and sanctioned by the UK and US, as part of a joint campaign targeting international cyber criminals.

Image courtesy NCA

The US Department of Justice is concurrently unsealing indictments against nine individuals in connection with the Trickbot malware conspiracy and Conti ransomware conspiracy, including seven of the individuals designated today.

Investigations by the NCA and FBI identified that these men, all Russian nationals, were influential members of the group, working as developers, administrators who facilitated payments to the group from ransom funds, and managers who recruited new members from cyber crime forums.

Advertisement
Leonardo RT

Sanctioned Cyber BlogThe NCA assesses that the group was responsible for extorting at at least £27 million from 149 UK victims. Research by Chainalysis shows that the crime group is responsible for at least $800 million of extortion attacks globally.

The attackers sought to target UK hospitals, schools, local authorities and businesses.

Today’s sanctions have been brought by the FCDO and the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) and are the latest round of designations following the first ever joint UK-US sanctions against seven members of the same group in February this year.

NCA Director General of Operations Rob Jones said: “These sanctions are a continuation of our campaign against international cyber criminals.

“Attacks by this ransomware group have caused significant damage to our businesses and ruined livelihoods, with victims having to deal with the prolonged impact of financial and data losses.

“These criminals thought they were untouchable, but our message is clear: we know who you are and, working with our partners, we will not stop in our efforts to bring you to justice.”

All 18 of these cyber criminals are now subject to travel bans and asset freezes and are severely restricted in their use of the legitimate global financial system.

Assessment and industry reporting show that sanctions have disrupted ransomware operations, including hampering the ability of threat actors to monetise their criminal activities.

As well as disrupting the activities of ransomware criminals via sanctions, the NCA has been working with international partners to target the tools and services that underpin their offending.

Last week, the NCA supported the FBI and DoJ in the takedown of Qakbot malware, which facilitated ransomware attacks and caused millions of pounds worth of damage worldwide.

Over a period of 16 years, Qakbot was used by the Conti group, as well as the criminals behind the ProLock, Egregor, REvil and Black Basta ransomware strains, to steal personal data including banking credentials, from victims.

Although the Conti group disbanded last year, reporting suggests its members, including those sanctioned today, continue to be involved in some of the most notorious new ransomware strains that dominate and threaten UK security.

The group was also one of the first to offer support for Russia’s invasion of Ukraine and key group members highly likely maintain links to the Russian Intelligence Services from whom they have likely received tasking.

Foreign Secretary James Cleverly said: “These cyber-criminals thrive off anonymity, moving in the shadows of the internet to cause maximum damage and extort money from their victims.

“Our sanctions show they cannot act with impunity. We know who they are and what they are doing.

“By exposing their identities, we are dismantling their business models, making it harder for them to target our people, our businesses and our institutions.”

Security Minister Tom Tugendhat said: “These sanctions demonstrate that the UK will crackdown on those trying to hold UK businesses and infrastructure to ransom. We will use our law enforcement agencies to go after the perpetrators and punish their crimes.

“We have the skills and resources to find and unmask criminals who attempt to steal from British businesses, schools and hospitals.

Advertisement
DSEI 2025

“We will keep working with our partners, like the US, to defeat these threats.”

NCSC CEO Lindy Cameron said: “Alongside this latest round of sanctions, I strongly encourage organisations to proactively obstruct the activities of ransomware operatives by bolstering their online resilience.

“Ransomware continues to be a significant threat facing the UK and attacks can have significant and far-reaching impact.

“The NCSC has published free and actionable advice for organisations of all sizes on how to put robust defences in place to protect their networks.”

The individuals being designated in the UK and US today are:

  • Andrey Zhuykov was a central actor in the group and a senior administrator. Known by the online monikers “Defender”, “Dif” and “Adam”.
  • Maksim Galochkin led a group of testers, with responsibilities for development, supervision and implementation of tests. Known by the online monikers “Bentley”, “Volhvb” and “Max17”
  • Maksim Rudenskiy was a key member of the Trickbot group and was the team lead for coders. Known by the online monikers “Buza”, “Silver” and “Binman”.
  • Mikhail Tsarev was a mid-level manager who assisted with the group's finances and overseeing of HR functions. Known by the online monikers “Mango”, “Frances” and “Khano”.
  • Dmitry Putilin was associated with the purchase of Trickbot infrastructure. Known by the online monikers “Grad” and “Staff”.
  • Maksim Khaliullin was an HR manager for the group. He was associated with the purchase of Trickbot infrastructure including procuring Virtual Private Servers (VPS). Known by the online moniker “Kagas”.
  • Sergey Loguntsov was a developer for the group. Known by the online monikers “Begemot”, “Begemot_Sun” and “Zulas”.
  • Alexander Mozhaev was part of the admin team responsible for general administration duties. Known by the online monikers “Green” and “Rocco”.
  • Vadym Valiakhmetov worked as a coder and his duties included backdoor and loader projects. Known by the online monikers “Weldon”, “Mentos” and “Vasm”.
  • Artem Kurov worked as a coder with development duties in the Trickbot group. Known by the online moniker “Naned”.
  • Mikhail Chernov was part of the internal utilities group. Known by the online monikers “Bullet” and “m2686”.

Guidance for ransomware victims
If you are the victim of a ransomware attack, you should use the UK Government’s Cyber Incident Signposting Site as soon as possible for direction on which agencies to report your incident to.

The Office of Financial Sanctions Implementation has published guidance, which sets out the implications of sanctions in ransomware cases.

Making funds available to the individuals such as paying ransomware, including in cryptoassets, is prohibited under these sanctions.

Organisations should have or should put in place robust cyber security and incident management systems in place to prevent and manage serious cyber incidents.

 

 

 

Serco appoints Keith Williams as Chair

Aerospace Defence Security Space

Serco appoints Keith Williams as Chair

4 July 2025

Serco has appointed Keith Williams to the Board as a Non-Executive Director and Chair designate.

Boeing appoints Stephen Parker as CEO of BDS

Defence Security Space

Boeing appoints Stephen Parker as CEO of BDS

3 July 2025

Boeing has appointed Stephen (Steve) Parker as president and chief executive officer of its Defense, Space & Security (BDS) business, effective immediately.

Lancashire aims at advancing cyber-enabled defence and security

Defence Security Events

Lancashire aims at advancing cyber-enabled defence and security

3 July 2025

Over 200 senior business leaders, investors, policymakers and academics from across the UK gathered this week at the Lancashire Cyber Festival to discuss Lancashire’s opportunity to become a global leader in cyber-enabled defence and security.

Airframe Designs aligns with US NCAMP standards

Aerospace Defence Security

Airframe Designs aligns with US NCAMP standards

3 July 2025

Airframe Designs has aligned its material systems with the US National Centre for Advanced Materials Performance (NCAMP) which works with the Federal Aviation Administration (FAA) and industry partners to support its existing testing processes.

Advertisement
Teledyne
Bernd Kögel to spearhead launch of DSEI Germany

Defence Security Events

Bernd Kögel to spearhead launch of DSEI Germany

3 July 2025

Clarion Events Defence and Security has announced the appointment of Colonel (ret) Bernd Kögel as Managing Director of DSEI Germany, effective 1st October 2025.

Siemens and NVIDIA team to drive AI in advanced manufacturing

Aerospace Defence Security

Siemens and NVIDIA team to drive AI in advanced manufacturing

2 July 2025

Siemens and NVIDIA are expanding their partnership to accelerate the next era of industrial AI and digitalisation, towards enabling the factory of the future.

Advertisement
DSEI 2025