The U.S. Treasury’s Office of Foreign Assets Control (OFAC) has taken action against two Iranian ransomware “facilitators.” The actions include publishing the perp’s cryptocurrency wallet addresses, and warning the cryptocurrency and financial communities that anyone transacting with the accused could be subject to secondary sanctions.
Involvement in the SamSam Ransomware Attacks
The OFAC stated that the two “Iran-based individuals,” are Ali Khorashadizadeh and Mohammad Ghorbaniyan. According to a U.S Treasury press release today they helped exchange Bitcoin ransom payments, obtained by “Iranian malicious cyber actors” involved in the SamSam ransomware scheme, into Iranian rial.
Khorashadizadeh and Ghorbaniyan are designated for:
Having materially assisted, sponsored, or provided financial, material, or technological support for, or goods or services to or in support of, the SamSam ransomware attacks.
OFAC has identified and published the two wallet addresses associated with the “facilitators.” The cryptocurrency wallet addresses processed around 6,000-7,000 Bitcoin (BTC) [coin_price] transactions across 40 cryptocurrency exchanges. Even at today’s Bitcoin price, this would equate to a value of over $25 million.
The U.S Department of Justice has also indicted two actors for infecting over 200 networks with SamSam ransomware in the U.S, UK, and Canada since 2015. One hospital in Indiana lost all its IT networks during storms, leading them to pay the ransom to protect patients.
The news quickly sparked a conversation on social media.
1/ BREAKING: For the first time in history, the US has sanctioned a bitcoin address. https://t.co/5iFmXAaF8l
— Marco Santori (@msantoriESQ) November 28, 2018
1/ Today, the US Department of the Treasury, through the Office of Foreign Assets Control (OFAC) took the historic step of adding two Bitcoin addresses to its list of sanctioned parties. In this thread, I'll break down what that means.
— Marco Santori (@msantoriESQ) November 28, 2018
First Publishing of Wallet Addresses
OFAC says that although it usually shares “identifiers” with designated people:
Today’s action marks the first time OFAC is publicly attributing digital currency addresses to designated individuals.
The operators recognizing or finding the published wallet addresses are required to comply with OFAC obligations regardless of whether transactions are conducted in fiat or digital currency:
Like traditional identifiers, these digital currency addresses should assist those in the compliance and digital currency communities in identifying transactions and funds that must be blocked and investigating any connections to these addresses.
Any property or financial “interests” of the individuals are now subject to OFAC sanctions and “U.S. persons generally are prohibited from dealing with them.”
The Treasury and OFAC actions today are part of a wider round of sanctions and “U.S economic pressure” targeting Iran “designed to blunt the broad spectrum of the Iranian regime’s malign activities and compel the regime to change its behavior.”
Treasury Under Secretary for Terrorism and Financial Intelligence Sigal Mandelker warns:
Treasury will aggressively pursue Iran and other rogue regimes attempting to exploit digital currencies and weaknesses in cyber and AML/CFT safeguards to further their nefarious objectives.
What are your thoughts on the new sanctions? Let us know in the comments below.
Images and media courtesy of Bitcoinist archives, Shutterstock, Twitter (@msantoriESQ).