PRESS RELEASES

United States and United Kingdom Sanction Members of Russia-Based Trickbot Cybercrime Gang

February 9, 2023

The United States and United Kingdom issue historic joint cyber sanctions

WASHINGTON — Today, the United States, in coordination with the United Kingdom, is designating seven individuals who are part of the Russia-based cybercrime gang Trickbot. This action represents the very first sanctions of their kind for the U.K., and result from a collaborative partnership between the U.S. Department of the Treasury’s Office of Foreign Assets Control and the U.K.’s Foreign, Commonwealth, and Development Office; National Crime Agency; and His Majesty’s Treasury to disrupt Russian cybercrime and ransomware.

“Cyber criminals, particularly those based in Russia, seek to attack critical infrastructure, target U.S. businesses, and exploit the international financial system,” said Under Secretary Brian E. Nelson.  “The United States is taking action today in partnership with the United Kingdom because international cooperation is key to addressing Russian cybercrime.”

Russia is a haven for cybercriminals, where groups such as Trickbot freely perpetrate malicious cyber activities against the U.S., the U.K., and allies and partners. These malicious cyber activities have targeted critical infrastructure, including hospitals and medical facilities during a global pandemic, in both the U.S. and the U.K. Last month, Treasury’s Financial Crimes Enforcement Network (FinCEN) identified a Russia-based virtual currency exchange, Bitzlato Limited, as a “primary money laundering concern” in connection with Russian illicit finance.  The United States and the United Kingdom are leaders in the global fight against cybercrime and are committed to using all available authorities and tools to defend against cyber threats.

This action follows other recent sanctions actions taken jointly by the U.S. and the U.K. including in the Russia and Burma programs, as well as last year’s multilateral action against the Kinahan Crime Group. It also reflects the finding from the 2021 Sanctions Review that sanctions are most effective when coordinated with international partners and highlights the deepened partnership between OFAC and the UK’s Office of Financial Sanctions Implementation.

TRICKBOT: A NOTORIOUS CYBER GANG IN RUSSIA

Trickbot, first identified in 2016 by security researchers, was a trojan virus that evolved from the Dyre trojan. Dyre was an online banking trojan operated by individuals based in Moscow, Russia, that began targeting non-Russian businesses and entities in mid-2014.  Dyre and Trickbot were developed and operated by a group of cybercriminals to steal financial data. The Trickbot trojan viruses infected millions of victim computers worldwide, including those of U.S. businesses, and individual victims. It has since evolved into a highly modular malware suite that provides the Trickbot Group with the ability to conduct a variety of illegal cyber activities, including ransomware attacks. During the height of the COVID-19 pandemic in 2020, Trickbot targeted hospitals and healthcare centers, launching a wave of ransomware attacks against hospitals across the United States. In one of these attacks, the Trickbot Group deployed ransomware against three Minnesota medical facilities, disrupting their computer networks and telephones, and causing a diversion of ambulances. Members of the Trickbot Group publicly gloated over the ease of targeting the medical facilities and the speed with which the ransoms were paid to the group.

Current members of the Trickbot Group are associated with Russian Intelligence Services. The Trickbot Group’s preparations in 2020 aligned them to Russian state objectives and targeting previously conducted by Russian Intelligence Services. This included targeting the U.S. government and U.S. companies.

Vitaly Kovalev was a senior figure within the Trickbot Group. Vitaly Kovalev is also known as the online monikers “Bentley” and “Ben”. Today, an indictment was unsealed in the U.S. District Court for the District of New Jersey charging Kovalev with conspiracy to commit bank fraud and eight counts of bank fraud in connection with a series of intrusions into victim bank accounts held at various U.S.-based financial institutions that occurred in 2009 and 2010, predating his involvement in Dyre or the Trickbot Group.

Maksim Mikhailov has been involved in development activity for the Trickbot Group. Maksim Mikhailov is also known as the online moniker “Baget”.

Valentin Karyagin has been involved in the development of ransomware and other malware projects. Valentin Karyagin is also known as the online moniker “Globus”.

Mikhail Iskritskiy has worked on money-laundering and fraud projects for the Trickbot Group. Mikhail Iskritskiy is also known as the online moniker “Tropa”.

Dmitry Pleshevskiy worked on injecting malicious code into websites to steal victims’ credentials. Dmitry Pleshevskiy is also known as the online moniker “Iseldor”.

Ivan Vakhromeyev has worked for the Trickbot Group as a manager. Ivan Vakhromeyev is also known as the online moniker “Mushroom”.

Valery Sedletski has worked as an administrator for the Trickbot Group, including managing servers. Valery Sedletski is also known as the online moniker “Strix”.

OFAC is designating each of these individuals pursuant to Executive Order (E.O.) 13694, as amended by E.O. 13757, for having materially assisted, sponsored, or provided material, or technological support for, or goods or services to or in support of, an activity described in subsection (a)(ii) of section 1 of E.O. 13694, as amended.

SANCTIONS IMPLICATIONS

As a result of today’s action, all property and interests in property of the individuals that are in the United States or in the possession or control of U.S. persons must be blocked and reported to OFAC. OFAC’s regulations generally prohibit all dealings by U.S. persons or within the United States (including transactions transiting the United States) that involve any property or interests in property of blocked or designated persons.

In addition, persons that engage in certain transactions with the individuals designated today may themselves be exposed to designation. Furthermore, any foreign financial institution that knowingly facilitates a significant transaction or provides significant financial services for any of the individuals or entities designated today could be subject to U.S. correspondent or payable-through account sanctions.

The power and integrity of OFAC sanctions derive not only from its ability to designate and add persons to the Specially Designated Nationals and Blocked Persons (SDN) List but also from its willingness to remove persons from the SDN List consistent with the law. The ultimate goal of sanctions is not to punish but to bring about a positive change in behavior. For information concerning the process for seeking removal from an OFAC list, including the SDN List, please refer to OFAC’s Frequently Asked Question 897. For detailed information on the process to submit a request for removal from an OFAC sanctions list, please refer to OFAC’s website.

See OFAC’s Updated Advisory on Potential Sanctions Risk for Facilitating Ransomware Payments for information on the actions that OFAC would consider to be mitigating factors in any related enforcement action involving ransomware payments with a potential sanctions risk. For information on complying with sanctions applicable to virtual currency, see OFAC’s Sanctions Compliance Guidance for the Virtual Currency Industry . See also the UK’s Office of Financial Sanctions Implementation’s recently issued Guidance on Financial Sanctions and Ransomware.

U.S. Treasury Department Press Release

Taking Joint Action Against Cybercriminals

PRESS STATEMENT

ANTONY J. BLINKEN, SECRETARY OF STATE

FEBRUARY 9, 2023

The United States and the United Kingdom are taking coordinated action today targeting cybercriminals who launched assaults against our critical infrastructure. We will continue to work with the United Kingdom and with other international partners to expose and disrupt cybercrime emanating from Russia.
The United States is designating seven individuals who are part of the Russia-based cybercrime gang Trickbot. We are taking this action pursuant to Executive Order (E.O.) 13694, as amended by E.O. 13757, for the individuals’ involvement in a cyber-enabled activity that poses a significant threat to the national security, foreign policy, or economic health or financial stability of the United States.
Russia is a safe haven for cybercriminals, where groups such as Trickbot freely perpetrate malicious cyber activities against the United States, the United Kingdom, and our allies and partners. These activities have targeted critical infrastructure, including hospitals and medical facilities.

The United States and the United Kingdom are leaders in the global fight against cybercrime and are committed to using all available authorities to defend against cyber threats. Today’s action, the first under the UK’s new cyber sanctions authority, demonstrates our continued commitment to collaborating with partners and allies to address Russia-based cybercrime, and to countering ransomware attacks and their perpetrators. As Russia’s illegal war against Ukraine continues, cooperation with our allies and partners is more critical than ever to protect our national security.

U.S. State Department Press Release

PRESS RELEASES

Treasury Sanctions Companies Involved in Production, Sale, and Shipment of Iranian Petrochemicals and Petroleum

February 9, 2023

WASHINGTON — Today, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) sanctioned nine entities across multiple jurisdictions that have played a critical role in the production, sale, and shipment of hundreds of millions of dollars’ worth of Iranian petrochemicals and petroleum to buyers in Asia. Treasury is targeting six Iran-based petrochemical manufacturers or their subsidiaries, and three firms in Malaysia and Singapore involved in facilitating the sale and shipment of petroleum and petrochemicals on behalf of Triliance Petrochemical Co. Ltd., which OFAC designated on January 23, 2020 for facilitating the sale of Iranian petroleum products from the National Iranian Oil Company (NIOC).

“Iran increasingly turning to buyers in East Asia to sell its petrochemical and petroleum products, in violation of U.S. sanctions,” said Under Secretary of the Treasury for Terrorism and Financial Intelligence Brian E. Nelson. “The United States remains focused on targeting Tehran’s sources of illicit revenue, and will continue to enforce its sanctions against those who wittingly facilitate this trade.”

Today’s action was taken pursuant to Executive Order (E.O.) 13846 and follows OFAC’s November 17, 2022 designation of 13 companies in the UAE and Hong Kong for facilitating the sale of Iranian petrochemicals and petroleum products to buyers in East Asia on behalf of Triliance and sanctioned Iranian petrochemical broker Persian Gulf Petrochemical Industry Commercial Co. (PGPICC), as well as on behalf of NIOC and its marketing arm, Naftiran Intertrade Company Ltd. (NICO). 

IRANIAN PETROCHEMICAL PRODUCERS

OFAC is designating Iranian petrochemical producer Amir Kabir Petrochemical Company (AKPC), a major polyethylene producer. Triliance has purchased millions of dollars’ worth of low density polyethylene (LDPE) produced by AKPC for shipment to buyers in the People’s Republic of China (PRC). OFAC is also adding Simorgh Petrochemical Company, a fully owned subsidiary of AKPC, to the List of Specially Designated Nationals and Blocked Persons (“SDN List”). 

OFAC is designating AKPC pursuant to E.O. 13846 for, on or after November 5, 2018, having materially assisted, sponsored, or provided financial, material, or technological support for, or goods or services to or in support of, Triliance. OFAC is adding Simorgh Petrochemical Company to the SDN List for being owned in the aggregate, directly or indirectly, 50 percent or more by AKPC. 

OFAC is also taking action against four subsidiaries of Iran’s Marun Petrochemical Company, which OFAC designated on June 16, 2022 for its role in supplying millions of dollars’ worth of petrochemicals to Triliance. Iran-based Laleh Petrochemical Company, Marun Tadbir Tina Company, Marun Sepehr Ofogh Company, and Marun Supplemental Industries Company, each of which operate in different capacities within the petrochemical and industrial sectors, are majority- or fully owned by Marun Petrochemical Company.

OFAC is adding Laleh Petrochemical Company, Marun Tadbir Tina Company, Marun Sepehr Ofogh Company, and Marun Supplemental Industries Company to the SDN List for being owned in the aggregate, directly or indirectly, 50 percent or more by Marun Petrochemical Company. 

TRILIANCE NETWORK ENABLERS

Since late 2021, Singapore-based Asia Fuel PTE. Ltd. (Asia Fuel) has facilitated the shipment of petroleum products worth millions of dollars to customers in East Asia. Asia Fuel also arranged to pay storage fees on behalf of Triliance to house petroleum products in a Malaysia-based floating storage vessel. 

Sense Shipping and Trading SDN. BHD. (Sense Shipping) is a Kuala Lumpur, Malaysia-based front company for Triliance that has facilitated Triliance’s shipment of tens of thousands of metric tons of petrochemicals to foreign customers. Sense Shipping previously operated under the name Eastchem Shipping SDN. BHD.

Singapore-based Unicious Energy PTE. Ltd. serves an important role in Triliance’s network, coordinating millions of dollars in petroleum-related payments for other companies within the network and aiding Triliance in its sale of hundreds of millions of dollars of petroleum products.

OFAC is designating Asia Fuel PTE. Ltd., Sense Shipping and Trading SDN. BHD., and Unicious Energy PTE. Ltd., pursuant to E.O. 13846 for, on or after November 5, 2018, having materially assisted, sponsored, or provided financial, material, or technological support for, or goods or services to or in support of, Triliance, a person included on the SDN List whose property and interests in property are blocked pursuant to section 1(a) of E.O. 13846.

SANCTIONS IMPLICATIONS

As a result of today’s action, all property and interests in property of these targets that are in the United States or in the possession or control of U.S. persons must be blocked and reported to OFAC. In addition, any entities that are owned, directly or indirectly, 50 percent or more by one or more blocked persons are also blocked. OFAC’s regulations generally prohibit all dealings by U.S. persons or within the United States (including transactions transiting the United States) that involve any property or interests in property of blocked or designated persons.

In addition, persons that engage in certain transactions with the individuals and entities designated today may themselves be exposed to sanctions or subject to an enforcement action. Furthermore, unless an exception applies, any foreign financial institution that knowingly facilitates a significant transaction for any of the individuals or entities designated today could be subject to U.S. sanctions.

The power and integrity of OFAC sanctions derive not only from its ability to designate and add persons to the SDN List, but also from its willingness to remove persons from the SDN List consistent with the law. The ultimate goal of sanctions is not to punish, but to bring about a positive change in behavior. For information concerning the process for seeking removal from an OFAC list, including the SDN List, please refer to OFAC’s Frequently Asked Question 897 here. For detailed information on the process to submit a request for removal from an OFAC sanctions list, please click here.

U.S. Treasury Department Press Release

Designating Entities Involved in the Iranian Petrochemical and Petroleum Products Trade

PRESS STATEMENT

ANTONY J. BLINKEN, SECRETARY OF STATE

FEBRUARY 9, 2023

The United States is designating nine entities, pursuant to Executive Order 13846, that are involved in Iran’s petrochemical and petroleum products trade.

The Department of the Treasury is designating six Iran-based companies involved in the sale and distribution of petrochemicals.  Amir Kabir Petrochemical Company has produced and sold millions of dollars’ worth of low-density polyethylene to U.S.-designated Triliance Petrochemical Company.  Simorgh Petrochemical Company is owned by Amir Kabir Petrochemical Company.  Laleh Petrochemical Company, Marun Tadbir Tina Company, Marun Sepehr Ofogh Company, and Marun Supplemental Industries Company are owned by Marun Petrochemical Company, which was previously designated for providing material support to Triliance.

The Treasury Department is also designating two Singapore-based entities, Asia Fuel PTE. Ltd. and Unicious Energy PTE. Ltd., which have facilitated Triliance’s sale of petroleum products to customers in East Asia.

Finally, the Treasury Department is designating Malaysia-based Sense Shipping and Trading SDN. BHD., a front company that has facilitated the shipment of tens of thousands of metric tons of petrochemicals for Triliance.

Today’s action demonstrates our continued efforts to enforce U.S. sanctions on Iran’s petroleum and petrochemical trade and disrupt Iran’s efforts to circumvent sanctions.

U.S. State Department Press Release

Press release

UK cracks down on ransomware actors

The UK has sanctioned 7 Russian cyber criminals through coordinated actions with the US government.From:Foreign, Commonwealth & Development Office, Home Office, National Crime Agency, Office of Financial Sanctions Implementation, National Cyber Security Centre, The Rt Hon James Cleverly MP, and The Rt Hon Tom Tugendhat MBE VR MPPublished9 February 2023

• seven Russian nationals have assets frozen and travel bans imposed
• ransomware is a tier 1 national security threat, with attacks against businesses and public sector organisations increasingly common. Recent victims include UK schools, local authorities and firms – whilst internationally the Irish Health Service Executive, Costa Rican government and American healthcare providers were targeted
• new campaign of concerted action is being coordinated with the US, after 149 British victims of ransomware known as Conti and Ryuk were identified by the National Crime Agency (NCA)

Seven Russian cyber criminals have today (Thursday 9 February) been sanctioned by the UK and US in the first wave of new coordinated action against international cyber crime. These individuals have been associated with the development or deployment of a range of ransomware strains which have targeted the UK and US.

Foreign Secretary James Cleverly said:

By sanctioning these cyber criminals, we are sending a clear signal to them and others involved in ransomware that they will be held to account.

These cynical cyber attacks cause real damage to people’s lives and livelihoods. We will always put our national security first by protecting the UK and our allies from serious organised crime – whatever its form and wherever it originates.

Ransomware criminals specifically target the systems of organisations they judge will pay them the most money and time their attacks to cause maximum damage, including targeting hospitals in the middle of the pandemic.

Ransomware groups known as Conti, Wizard Spider, UNC1878, Gold Blackburn, Trickman and Trickbot have been responsible for the development and deployment of: Trickbot, Anchor, BazarLoader, BazarBackdoor as well as the ransomware strains Conti and Diavol. They are also involved in the deployment of Ryuk ransomware.

The ransomware strains known as Conti and Ryuk affected 149 UK individuals and businesses. The ransomware was responsible for extricating at least an estimated £27 million. There were 104 UK victims of the Conti strain who paid approximately £10 million and 45 victims of the Ryuk strain who paid approximately £17 million.

Conti was behind attacks that targeted hospitals, schools, businesses and local authorities, including the Scottish Environment Protection Agency.  The group behind Conti extorted $180 million in ransomware in 2021 alone, according to research from Chainalysis.

Conti was one of the first cyber crime groups to back Russia’s war in Ukraine, voicing their support for the Kremlin within 24 hours of the invasion.

Although the ransomware group responsible for Conti disbanded in May 2022, reporting suggests members of the group continue to be involved in some of the most notorious new ransomware strains that dominate and threaten UK security.

Security Minister Tom Tugendhat said:

We’re targeting cyber criminals who have been involved in some of the most prolific and damaging forms of ransomware. Ransomware criminals have hit hospitals and schools, hurt many and disrupted lives, at great expense to the taxpayer.

Cyber crime knows no boundaries and threatens our national security. These sanctions identify and expose those responsible.

A wide range of organisations have been targeted by ransomware criminals, including at least 10 schools and universities in the UK, as well as hospitals, a forensic laboratory and local authorities. The Government of Costa Rica was also targeted last year.

Ireland’s Health Service Executive were targeted by ransomware actors during the COVID pandemic, leading to disruption to blood tests, x-rays, CT scans, radiotherapy and chemotherapy appointments over 10 days.

Another recent ransomware attack included Harrogate-based transportation and cold storage firm Reed Boardall whose IT systems were under attack for nearly a week in 2021.

These sanctions follow a complex, large-scale and ongoing investigation led by the NCA, which will continue to pursue all investigative lines of enquiry to disrupt the ransomware threat to the UK in collaboration with partners.

National Crime Agency Director-General Graeme Biggar said:

This is a hugely significant moment for the UK and our collaborative efforts with the US to disrupt international cyber criminals.

The sanctions are the first of their kind for the UK and signal the continuing campaign targeting those responsible for some of the most sophisticated and damaging ransomware that has impacted the UK and our allies. They show that these criminals and those that support them are not immune to UK action, and this is just one tool we will use to crack down on this threat and protect the public.

This is an excellent example of the dedication and expertise of the NCAteam who have worked closely with partners on this complex investigation. We will continue to deploy our unique capabilities to expose cyber criminals and work alongside our international partners to hold those responsible to account, wherever they are in the world.

UK and US authorities will continue to expose these cyber criminals and crack down on their activities. This announcement of sanctions against 7 individuals marks the start of a campaign of coordinated action against ransomware actors being led by the UK and US.

The National Cyber Security Centre (NCSC), a part of GCHQ, has assessed that:

• it is almost certain that the Conti group were primarily financially motivated and chose their targets based on the perceived value they could extort from them
• key group members highly likely maintain links to the Russian Intelligence Services from whom they have likely received tasking. The targeting of certain organisations, such as the International Olympic Committee, by the group almost certainly aligns with Russian state objectives
• it is highly likely that the group evolved from previous cyber organised crime groups and likely have extensive links to other cyber criminals, notably EvilCorp and those responsible for Ryuk ransomware

NCSC Chief Executive Officer Lindy Cameron said:

Ransomware is the most acute cyber threat facing the UK, and attacks by criminal groups show just how devastating its impact can be.

The NCSC is working with partners to bear down on ransomware attacks and those responsible, helping to prevent incidents and improve our collective resilience.

It is vital organisations take immediate steps to limit their risk by following the NCSC’s advice on how to put robust defences in place to protect their networks.

Victims of ransomware attacks should use the UK government’s Cyber Incident Signposting Site as soon as possible after an attack.

Today, the UK’s Office of Financial Sanctions Implementation (OFSI) are also publishing new public guidance which sets out the implications of these new sanctions in ransomware cases.

The individuals designated today are:

• Vitaliy Kovalev
• Valery Sedletski
• Valentin Karyagin
• Maksim Mikhailov
• Dmitry Pleshevskiy
• Mikhail Iskritskiy
• Ivan Vakhromeyev

Making funds available to the individuals such as paying ransomware, including in crypto assets, is prohibited under these sanctions. Organisations should have or should put in place robust cyber security and incident management systems in place to prevent and manage serious cyber incidents.

Read further guidance on UK sanctions relating to cyber activity and view the full UK Sanctions List.

OFSI/FCDO Press Release