Members of Russian cybercrime network exposed by US and UK authorities
The accused cybercriminals had their assets frozen and travel bans imposed. The sanctions also prohibit companies and organizations in the US and UK from making money available to the seven individuals, including cryptocurrency extortion payments.
Vitaly Kovalev, Maksim Mikhailov, Valentin Karyagin, Mikhail Iskritskiy, Dmitry Pleshevskiy, Ivan Vakhromeyev and Valery Sedletski are reportedly members of the The Russian-based cybercrime gang Trickbotwhich is now believed to be affiliated with a single network connected to the Ryuk And (allegedly) disbanded Conti ransomware groups. The group is accused of fraud, money laundering and developing malicious hacking tools.
Trickbot’s eponymous Trojan malware tool was originally designed to capture internet banking credentials, but has since grown into a sprawling malware venture responsible for infecting millions of computers around the world. The U.S. Treasury Department alleges that Trickbot targeted hospitals during the height of the 2020 covid pandemic, with three Minnesota medical facilities forced to divert ambulances due to the resulting disruption to telephone and computer networks.
The sanctioned group members are based in Russia, which does not extradite to the UK or the US
US authorities have also filed charges against Kovalev, a “senior figure” within Trickbot, also known as “Bentley”, who is now charged with conspiracy to commit bank fraud and eight counts of bank fraud. All seven of the suspects to be sanctioned are based in Russia, which has no extradition treaty with the US or UK.
“By punishing these cybercriminals, we are sending a clear signal to them and others involved in ransomware that they will be held accountable,” British Foreign Secretary James Cleverly said in a statement. “These cynical cyberattacks are causing real damage to people’s lives and livelihoods. We will always put our national security first by protecting the UK and our allies from serious organized crime – whatever its form and wherever it comes from.”
Authorities in both the UK and US also said on Thursday that current members of the Trickbot group have ties to Russian intelligence. “The preparations of the Trickbot Group in 2020 aligned them with the objectives of the Russian state and the attacks previously carried out by the Russian intelligence services,” read a statement from the US Treasury Department. “This included targeting the US government and US companies.”
Britain’s National Cyber Security Center similarly claims that members of the Conti group “most likely have ties to the Russian intelligence services from whom they likely received orders. The group’s attacking certain organizations, such as the International Olympic Committee, is almost certainly consistent with the objectives of the Russian state.”
The sanctions are the first of their kind for the UK and mark the start of a new wave of coordinated action between the US and the UK against international cybercrime. Just last month, US authorities accused crypto exchange Bitzlato of playing a critical role in facilitating transactions for Russia-affiliated ransomware groups like Conti and arrested Bitzlato’s Russian co-founder for allegedly processing $700 million to illegal funds.
