The United Kingdom, in cooperation with US authorities, has imposed sanctions on seven Russian hackers responsible for ransomware attacks on British government agencies, marking the first time that sanctions have been imposed on the individuals behind such attacks. Attack type. This decision was the result of a thorough investigation by the UK's National Crime Agency.
The attackers use Ryuk and Conti ransomware, which has been used for such attacks since 2018 because it encrypts sensitive files on infected devices to prevent victims from accessing them until the attackers pay the required amount.
In addition to the two programs mentioned above, hackers have also used Trickbot Trojan, which targets banking systems to steal financial data and give hackers full control over victims' devices.
In a statement announcing the news, the UK government said ransomware attacks pose a Level 1 security threat, particularly as its use against businesses and government agencies increases. It added that victims of the program included schools, municipalities, businesses and international bodies such as the Irish Health Service, the Costa Rican government and US health authorities. He said that the death toll from these attacks reached 149 in the United Kingdom alone.
The statement said that the perpetrators of the aforementioned extortion attacks are carefully evaluating their targets to determine who can pay the maximum amount at a time when the attack causes the most damage, such as targeting hospitals because of their fears of the Corona epidemic, and the crisis means stopping blood tests, x-rays and chemotherapy for ten days. .
The campaign continues, targeting some of the most harmful ransomware applications to wreak havoc on the UK and its allies.
The UK government press release raises the strong possibility that there are links between those affected by the sanctions and the Russian intelligence services that ordered the operations. The UK also argues that the group traces its origins to a previously organized cybercrime group and may have ties to other similar groups, such as EvilCorp and the group behind the Ryuk ransomware.
The sanctions include travel bans and asset freezes for members of the targeted groups, as well as a ban on British companies from paying them ransoms, including via digital currencies. The government statement urged British companies to take strict security measures to prevent such attacks in the future.
In a statement, the US Treasury warned that any foreign financial institution intending to transact or provide essential financial services to an affected person or entity could be subject to US sanctions.
It should be noted that Statica Research Foundation has released statistics showing that the number of ransomware attacks will exceed 236 million in the first half of 2022.