US Treasury says those who facilitate payments on behalf of ransomware victims, including digital forensics firms, face fines if recipients are under sanctions
Brian Krebs / Krebs on Security :
Context & Ripple Effects
This advisory is the quiet groundwork for what became a full sanctions campaign against the ransomware money trail. A year earlier, Treasury had already designated three North Korean hacking groups behind WannaCry (Lazarus, Bluenoroff, and Andarial), establishing that ransomware operators themselves can be sanctioned parties. What changed here is the target: instead of going after attackers, Treasury is warning the intermediaries — digital forensics firms, incident responders, anyone who brokers a victim's payment — that they inherit the legal risk.
The enforcement teeth arrived soon after: Treasury sanctioned crypto exchange Suex for laundering proceeds from at least eight ransomware variants, its first strike at an exchange rather than a hacker group. And a Treasury report later showed why intermediaries matter so much — financial firms flagged only ~$600M of an estimated $5.2B in suspected ransomware payments in H1 2021, meaning the vast majority of the flow is invisible to regulators unless someone in the payment chain screens it.
First-order effects
- Digital forensics and incident-response firms now have to run OFAC sanctions screening on every wallet or recipient before facilitating a ransom payment — turning a routine negotiation step into a compliance decision that can stall or kill a deal mid-crisis.
- Victims under attack face a harder path to paying: their own advisors may refuse to route funds if the recipient matches a sanctioned entity, leaving no compliant option when decryption is the only recovery route.
Second-order effects
- Payment routing shifts toward exchanges and mixers with no US compliance posture — exactly the behavior that led Treasury to sanction Suex, suggesting each evasion channel eventually becomes the next designation target.
- Cyber insurers and breach coaches, who often direct victims to forensics firms, absorb the risk downstream: ransom coverage decisions now require sanctions diligence on the attacker's identity, something most policies never contemplated.
Third-order effects
- If the pattern holds, sanctions compliance becomes a structural layer of incident response itself — the ransomware economy splits between sanctioned actors whose payments cannot legally move and unsanctioned ones where they can, pushing attribution from a forensic nicety to a payment prerequisite.
- Treasury's approach makes intermediaries the enforcement chokepoint rather than hackers, a template it has since extended across crypto infrastructure — one that depends on closing the reporting gap the H1 2021 figures exposed.
The trend: The US is fighting ransomware through financial chokepoints, converting payment facilitators into de facto sanctions enforcers and progressively designating the exchanges that move the money.