Companies that agree to hand over cash to hackers to free their systems from ransomware may face prosecution or penalties, the US Treasury said on Thursday.
Advisories from both the Treasury's Office of Foreign Assets Control (OFAC) and its Financial Crimes Enforcement Network (FinCEN) have warned that many hacker groups are believed to be operating from countries under economic sanctions, as reported by Reuters.
Any companies engaging with groups inside these countries could be in breach of these sanctions, the advisories warned, even in those cases where the company was unaware of the hackers' location.
The OFAC's advisory cited cyber attacks that were linked to hacking groups from North Korea and Russia, which are both nations sanctioned by the US. The US government often imposes economic and trade sanctions on countries that it deems sponsors terrorism or that violate human rights.
These latest warnings from the OFAC and FinCEN show an intent to regulate a rapidly growing market of companies who help organisations pay off hackers, such as cyber insurance firms or security consultancies.
The Enforcement Network's advisory also warned that cyber security firms may need to register as 'money services' if they help make these ransomware payments. This would place a new requirement on a section of the cyber security industry that is rapidly growing.
An affected company's decision to pay a ransom is not necessarily illegal, though it is usually ill advised. A 2019 survey from AT&T Cybersecurity revealed that 40% of IT security professionals believe that there should be a law preventing firms from paying ransoms. The argument often centres on the problem of there being no guarantee that the hackers will fulfil their end of the bargain and return stolen data.
-
Cleo attack victim list grows as Hertz confirms customer data stolenNews Hertz has confirmed it suffered a data breach as a result of the Cleo zero-day vulnerability in late 2024, with the car rental giant warning that customer data was stolen.
-
Lateral moves in tech: Why leaders should support employee mobilityIn-depth Encouraging staff to switch roles can have long-term benefits for skills in the tech sector
-
Cleo attack victim list grows as Hertz confirms customer data stolen – and security experts say it won't be the last
News Hertz has confirmed it suffered a data breach as a result of the Cleo zero-day vulnerability in late 2024, with the car rental giant warning that customer data was stolen.
-
‘Phishing kits are a force multiplier': Cheap cyber crime kits can be bought on the dark web for less than $25 – and experts warn it’s lowering the barrier of entry for amateur hackersNews Research from NordVPN shows phishing kits are now widely available on the dark web and via messaging apps like Telegram, and are often selling for less than $25.
-
Healthcare systems are rife with exploits — and ransomware gangs have noticedNews Nearly nine-in-ten healthcare organizations have medical devices that are vulnerable to exploits, and ransomware groups are taking notice.
-
Alleged LockBit developer extradited to the USNews A Russian-Israeli man has been extradited to the US amid accusations of being a key LockBit ransomware developer.
-
February was the worst month on record for ransomware attacks – and one threat group had a field dayNews February 2025 was the worst month on record for the number of ransomware attacks, according to new research from Bitdefender.
-
CISA issues warning over Medusa ransomware after 300 victims from critical sectors impactedNews The Medusa ransomware as a Service operation compromised twice as many organizations at the start of 2025 compared to 2024
-
Warning issued over prolific 'Ghost' ransomware groupNews The Ghost ransomware group is known to act fast and exploit vulnerabilities in public-facing appliances
-
The Zservers takedown is another big win for law enforcementNews LockBit has been dealt another blow by law enforcement after Dutch police took 127 of its servers offline
