US Treasury links crypto addresses to Iranian ransomware scam

Getting your Trinity Audio player ready...

The U.S. Department of the Treasury has identified two separate wallet addresses linked to the latest Iranian crypto ransomware plot.

The department’s Office of Foreign Assets Control (OFAC) announced that two Iranian citizens, Ali Khorashadizadeh and Mohammad Ghorbaniyan, are to be added to its sanctions list, along with two crypto addresses linked to these individuals.

Including the crypto addresses within the scope of sanctions on Iran marks the first time a regulator has had to resort to blacklisting crypto wallet addresses on this basis. The wallet addresses will be included alongside other identifying information, such as their personal addresses, email addresses and known aliases.

OFAC had previously confirmed it would be including crypto wallet addresses in the data, in order to prevent Iranian actors from relying on cryptocurrency to evade sanctions.

Treasury Undersecretary for Terrorism and Financial Intelligence Sigal Mandelker said the move would stop illicit actors from relying on cryptocurrency to avoid sanctions.

“We are publishing digital currency addresses to identify illicit actors operating in the digital currency space. Treasury will aggressively pursue Iran and other rogue regimes attempting to exploit digital currencies and weaknesses in cyber and AML/CFT safeguards to further their nefarious objectives,” Mandelker said. “As Iran becomes increasingly isolated and desperate for access to U.S. dollars, it is vital that virtual currency exchanges, peer-to-peer exchangers, and other providers of digital currency services harden their networks against these illicit schemes.”

Khorashadizadeh and Ghorbaniyan are specifically linked to the SamSam ransomware, which has exploited over 200 organisations over a period of several years, including hospitals, government departments and universities.

The ransomware worked by holding data hostage, and demanding a ransom to be paid in BTC to the identified addresses.

The decision will be a blow to criminals and scammers worldwide, who continue to use crypto to avoid the detection of authorities in a number of criminal applications, including funding rogue states and financing terrorism.

It also means exchanges will now be held responsible for ensuring they don’t send funds to these addresses or individuals, with secondary sanctions warned against those who fail to comply.