Forest Global Training Partners

Cyber Risks · Krebs on Security

Ransomware Victims That Pay Up Could Incur Steep Fines from Uncle Sam

Summary: The Treasury Department's Office of Foreign Assets Control warned that companies victimized by ransomware, and firms that facilitate ransom payments on their behalf, could face steep fines if the attackers are already under U.S. economic sanctions. OFAC said sanctions violations can carry civil penalties based on strict liability, with fines of up to $20 million, and named sanctioned actors tied to ransomware including North Korea's Lazarus Group, two Iranians linked to SamSam, Cryptolocker developer Evgeniy Bogachev, and the Russian syndicate Evil Corp.

What's compelling: Under strict liability, a victim can be fined up to $20 million even if it had no knowledge or reason to know its extortionist was sanctioned - and OFAC said a self-initiated, timely, complete report to law enforcement counts as a significant mitigating factor if a sanctions nexus is later found.

Read the original at Krebs on Security ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026