Businesses, governments, and organizations that are hit by crippling ransomware attacks now have a new worry to contend with—big fines from the US Department of Treasury in the event that they pay to recover their data.
Treasury Department officials made that guidance official in an advisory published on Thursday. It warns that payments made to specific entities or to any entity in certain countries—specifically, those with a designated “sanctions nexus”—could subject the payer to financial penalties levied by the Office of Foreign Assets Control, or OFAC.
The prohibition applies not only to the group that is infected but also to any companies or contractors the hacked groups security or insurance engages with, including those who provide insurance, digital forensics, and incident response, as well as all financial services that help facilitate or process ransom payments.
“Facilitating a ransomware payment that is demanded as a result of malicious cyber activities may enable criminals and adversaries with a sanctions nexus to profit and advance their illicit aims,” the advisory stated. “For example, ransomware payments made to sanctioned persons or to comprehensively sanctioned jurisdictions could be used to fund activities adverse to the national security and foreign policy objectives of the United States. Ransomware payments may also embolden cyber actors to engage in future attacks. In addition, paying a ransom to cyber actors does not guarantee that the victim will regain access to its stolen data.”
Under law, US persons are generally prohibited from engaging directly or indirectly in transactions with people or organizations on the OFACs Designated Nationals and Blocked Persons List, other prohibited lists, or in Cuba, Iran, North Korea, and other countries or regions. In recent years, the Treasury Department has added several known cyber-threat groups to its designation list. They include:
- Evgeniy Mikhailovich Bogachev, the developer of Cryptolocker, an early ransomware variant that the OFAC says infected more than 234,000 computers, half of them in the United States
- Two Iranian nationals behind SamSam, the ransomware that crippled the city of Atlanta in 2018
- Individuals and groups connected to Lazarus Group, a hacker group sponsored by North Korea that US intelligence groups say was behind the WannaCry attacks that shut down computers worldwide
- “Evil Corp.,” a Russia-based criminal organization whose leader was indicted last year for allegedly using the notorious Dridex malware to drain more than $70 million from bank accounts in the US, UK, and elsewhere
To pay or not to pay?
Law enforcement officials and security consultants have generally advised against paying ransomware demands because the payments only fund and encourage new attacks. Unfortunately, paying the ransom is often the fastest and least-expensive way to recover. The City of Baltimore incurred a loss of more than $18 million after it was locked out of its IT systems. Attackers behind the ransomware had demanded $70,000. In response, some companies claiming to offer incident-response services for ransomware attacks simply pay the attackers.
Thursday's advisory didn't say that people are prohibited in all cases from paying ransoms.
"Under OFACs Enforcement Guidelines, OFAC will also consider a companys self-initiated, timely, and complete report of a ransomware attack to law enforcement to be a significant mitigating factor in determining an appropriate enforcement outcome if the situation is later determined to have a sanctions nexus. OFAC will also consider a companys full and timely cooperation witRead More – Source