US investigators traced ransomware payments back to companies in the Moscow skyscraper Federation Tower East, suggesting Russia tolerates ransomware operators
New York TimesAndrew E. Kramer
Context & Ripple Effects
The payment trail adds a corporate-location layer to an already broad U.S. ransomware investigation: the FBI had said many of the roughly 100 ransomware types it was examining traced back to Russia. That makes named companies in Federation Tower East more consequential than a general attribution claim.
Subsequent coverage shows the enforcement tension behind the finding: Russia's FSB detained alleged REvil members at the U.S. request, while a source said Russian citizens would not be transferred to the U.S.
First-order effects
U.S. investigators gain specific corporate and payment links to examine around Federation Tower East, rather than pursuing ransomware activity solely through malware and individual operators.
The findings sharpen scrutiny of Russia's role because the apparent commercial infrastructure supports the investigators' conclusion that operators are tolerated.
Second-order effects
Payment processors and companies connected to the identified trail become more valuable investigative choke points for U.S. agencies seeking to disrupt ransomware proceeds.
Russian enforcement faces greater pressure to act against identifiable crews, but the reported refusal to hand over Russian citizens preserves a limit on U.S. legal reach.
Third-order effects
The case points to ransomware enforcement becoming a contest over financial and corporate infrastructure as much as the malware groups themselves.
The trend: Ransomware enforcement is moving from broad national attribution toward tracing the financial and corporate infrastructure that enables operators to monetize attacks.
.@AndrewKramerNYT on Moscow's tallest skyscraper — an apparent hub of ransomware money laundering. Operators of some of the at least 15 cryptocurrency exchanges inside say they're being blamed for crimes they're unaware of. https://www.nytimes.com/...
Cybersleuths tracing money paid by American businesses, hospitals and city governments to Russian ransomware gangs found it led to one of Moscow's most prestigious addresses. https://www.nytimes.com/...
“American officials point to people like Maksim Yakubets, a skinny 34-year-old with a pompadour haircut whom the United States has identified as a kingpin of a major cybercrime operation calling itself Evil Corp.” I wonder if Yakubets is a fan of Mr. Robot. https://twitter.com/..…
“American cryptocurrency tracking services provide data to non-Russian exchanges to help them avoid illicit transactions but have refused to work with Russian traders” out of fear they might use the information to tip off criminals https://www.nytimes.com/...
U.S. intelligence narrows down those attacks on our hospitals and critical infrastructure to - HOLD ONTO YER BUTTS!!! - the Russians. With the de facto blessings of Putin. https://www.nytimes.com/...
Like the banks and insurance companies they share space with, those firms are likely to have chosen the site for its status and its stringent building security, said Mr. Smilyanets, the researcher at @RecordedFuture https://www.nytimes.com/...
Gen. Nakasone: “What we have seen over the past year..is a tremendous rise of implants and zero-day vulnerabilities and ransomware..."I think that's the world in which we live today." #thisishowtheytellmetheworldends https://www.nytimes.com/...
That this high-rise in Moscow's financial district has emerged as an apparent hub of such money laundering has convinced many security experts that the Russian authorities tolerate ransomware operators. https://www.nytimes.com/...
As noted below, CNN reported this summer that the US government had taken offensive action in response to ransomware, including compromising & surveilling cybercriminal networks, according to sources familiar with the situation. https://twitter.com/...
NEW: In interview at @ReaganInstitute's #RNDF, General Nakasone acknowledges operations against ransomware attacks. @CYBERCOM_DIRNSA: “We have taken actions and we have imposed costs.” https://www.nytimes.com/...