US Sanctions Cryptocurrency Exchange SUEX for Aiding Ransomware Gangs

The U.S. Treasury Department on Tuesday imposed sanctions on
Russian cryptocurrency exchange Suex for helping facilitate and
launder transactions from at least eight ransomware variants as
part of the government’s efforts to crack down on a surge in
ransomware incidents and make it difficult for bad actors to profit
from such attacks using digital currencies.

“Virtual currency exchanges such as SUEX are critical to the
profitability of ransomware attacks, which help fund additional
cybercriminal activity,” the department said^[1]
in a press release. “Analysis of known SUEX transactions shows that
over 40% of SUEX’s known transaction history is associated with
illicit actors. SUEX is being designated pursuant to Executive Order
13694^[2], as amended, for
providing material support to the threat posed by criminal
ransomware actors.”

According to blockchain analytics firm Chainalysis^[3], SUEX is legally
registered in the Czech Republic and operates out of offices in
Moscow and St. Petersburg, with the exchange’s 25 deposit addresses^[4]
receiving over $481 million in Bitcoin alone since becoming active
in February 2018. A substantial portion of those transfers —
amounting to nearly $162 million — originate from ransomware
operators such as Ryuk, Conti, and Maze, cryptocurrency scam
operators, darknet markets, and high-risk exchanges.

The development marks the first instance of such an action
against a virtual currency exchange and follows a wave of devastating ransomware attacks^[5] that have increased in
frequency and severity, hobbling critical infrastructure and
numerous entities in recent months and making them an economical
and national security threat. In 2020 alone, ransomware payments
are said to have totaled over $400 million, more than four times
that of 2019, with virtual currencies emerging as the principal
means to conduct transfers and associated money laundering
activities.

Ransomware refers to malicious software that’s engineered to
block access to computer systems, often by encrypting data or
programs to extort ransom payments from victims in exchange for
decrypting and restoring access to their systems or data. This is
also accompanied by a threat to publicly disclose targets’
sensitive files in a technique called double extortion.

“These payments represent just a fraction of the economic harm
caused by cyber-attacks, but they underscore the objectives of
those who seek to weaponize technology for personal gain,” the
Treasury Department added.

Officials also emphasized the role of virtual currencies in
furthering illicit activity through peer-to-peer exchangers,
mixers, and exchanges, not to mention help evade sanctions, carry
out ransomware schemes, and conduct other financially motivated
cyber crimes, making such technologies ripe for exploitation by bad
actors. However, in SUEX’s case, it helped facilitate illegal
activity “for their own illicit gains.”

Besides freezing all property assets of the designated target
that are subject to U.S. jurisdiction, U.S. citizens are generally
banned from performing transactions with sanctioned entities, and
financial institutions that engage in certain activities with them
could themselves face sanctions or be subjected to enforcement
actions.

What’s more, the U.S.Office of Foreign Assets Control (OFAC)
released^[6]
an updated advisory on the potential sanctions risks arising out of
settling with ransomware actors, urging victims and related
companies to not only refrain from paying ransoms but also “report
these incidents to and fully cooperate with law enforcement as soon
as possible.”

“Shutting down cryptocurrency-based money launderers is one of
the most important strategies to combat cryptocurrency-related
crime,” Chainalysis said. “It all comes down to incentives. If
cybercriminals have no way of moving ill-gotten cryptocurrency to
services where it can be stored safely or converted into cash,
there’s much less reason for them to use cryptocurrency in the
first place.”