Sanctions designation of ransomware groups
Listing by sanctions authorities of ransomware groups or individuals, which makes any payment to them unlawful and turns ransom negotiation into a compliance question.
As long as a ransomware group is just a set of anonymous criminals, paying its ransom is legal in most countries, even if discouraged. Everything changes when a sanctions authority lists it. In December 2019, the US Treasury designated Evil Corp and its alleged leader, accused of ties to Russian services; in 2023, the United States and the United Kingdom sanctioned members of the Trickbot network; in May 2024, together with Australia, they designated LockBit's alleged leader. From then on, any payment to these persons, directly or through an intermediary, is prohibited for nationals and companies of those countries, under a strict liability regime in the United States. The authorities clarified in 2020 and 2021 that this prohibition also covers insurers, negotiators and incident response providers that facilitate a payment. Designated groups responded by changing names and malware, so that victims could no longer identify them. Hence the central role of screening before any payment: the negotiator must establish, with the available technical evidence, that the attacker is not a sanctioned entity. Designation is thus the exact point where cyber risk becomes political risk: a state decision changes the cover of a private loss.
Textbook case: a US company encrypted by an unknown ransomware considers paying. The negotiator notes that the code and infrastructure overlap with those of an Evil Corp offshoot, designated by OFAC on December 5, 2019: payment is suspended, the company restores from backups, and the insurer pays only restoration costs and business interruption.
- US Treasury, designation of Evil Corp, 5 December 2019
- United States, United Kingdom and Australia, designation of Dmitry Khoroshev (LockBit), 7 May 2024
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.