US Treasury warns companies making payments to ransomware programs

The US Treasury Department has warned companies that facilitate ransomware payments on behalf of victims that they may face sanctions for doing so.

The White house prohibits the payment of cyber-extortionists

2020 will always be the year of COVID-19, and the consequences of the global pandemic will be very different. One of the offshoots of the pandemic has been an increase in the number of ransomware attacks carried out by cybercriminals.

As more and more people turn to digital and online methods of work, companies and individuals are falling victim to various attack vectors used by ransomware groups. Whether it’s a malicious email with a dodgy upload or an insider who infects the network through a backdoor for hackers, these attacks have been quite devastating.

The U.S. Treasury Department’s office of foreign assets control (OFAC) has issued a warning to companies that help victims pay ransom to recover valuable files and control of their systems from attackers.

Feeding the beast

Treasury consultants Express their belief that companies that facilitate such payments “not only encourage future threats from ransomware, but also risk violating OFAC rules.”

Simply put, any firms or individuals that help the victim of a ransomware attack can undermine America’s national security and foreign policy goals.

Over the past seven years, OFAC has identified a number of cybercrime groups as part of its cybercrime – related sanctions. This includes several ransomware attacks and the groups responsible for their development, distribution, and use.

This includes a number of programs such as Cryptolocker (2013), SamSam (2015), WannaCry (2017), Dridex malware (2015), and the relevant individuals or groups responsible for the attacks.

Payments can lead to problems

Ransomware attacks are incredibly debilitating in nature, as they usually encrypt sensitive data, information, and files on a computer or network of computers. Hackers then demand a ransom, usually in cryptocurrency, so that victims can regain control of their systems and data.

Some victims end up choosing to make these payments with the help of financial institutions, cyber insurance companies, and other firms that specialize in cybercrime and responding to these types of incidents.

However, OFAC is concerned that many of these payments are being sent to individuals, or even countries and jurisdictions under sanctions that pose a threat to America’s national security.

In fact, making or facilitating these payments is prohibited by current OFAC rules, and institutions can impose civil penalties for violations.

“OFAC may impose civil penalties for violating the Ordinance on the basis of strict liability, which means that a person subject to U.S. jurisdiction may be held civilly liable even if they did not know or had no reason to know that they were making a transaction with a person that is prohibited under the laws and sanctions orders administered by OFAC.”

Based on the above, it is easy to conclude that the United States government simply does not care about the fact that people’s privacy may be at risk. The main thing is about the ambitions.