UK imposes sanctions on Conti ransomware gang leaders

Significant moment

Graeme Biggar, director of the National Crime Agency (NCA), which identified the gang’s British victims and led the investigation, added: “This is a hugely significant moment for the UK and our collaborative efforts with the US to disrupt international cyber criminals.

“The sanctions are the first of their kind for the UK and signal the continuing campaign targeting those responsible for some of the most sophisticated and damaging ransomware that has impacted the UK and our allies. They show that these criminals and those that support them are not immune to UK action, and this is just one tool we will use to crack down on this threat and protect the public.

“This is an excellent example of the dedication and expertise of the NCA team who have worked closely with partners on this complex investigation,” said Biggar. “We will continue to deploy our unique capabilities to expose cyber criminals and work alongside our international partners to hold those responsible to account, wherever they are in the world.”

The NCA is continuing to pursue other investigative lines of inquiry to further disrupt the ransomware threat to British organisations, and today’s announcement marks the start of a joint campaign of coordinated action against ransomware actors being run alongside US partners.

It is, however, unlikely that any of the seven men involved will ever face justice in the West – Russia does not allow its citizens to be extradited and, given the current geopolitical climate, the chances of Moscow’s cooperation at any level are effectively zero. However, as is usual when governments take this sort of action, it is hoped the act of naming them will cause them considerable inconvenience, removing their ability to operate anonymously and highlighting the corruption and criminal links endemic in the Russian intelligence services.

Don Smith, vice-president of threat research at the Secureworks Counter Threat Unit, has been tracking Conti in its various guises for a long time.

“These sanctions represent positive, coordinated steps in the global fight against ransomware,” Smith told Computer Weekly.

“By targeting the specific named individuals in the sanctions today, [they] give law enforcement and financial institutions the mandates and mechanisms needed to seize assets and cause financial disruption to the designated individuals, while avoiding criminalising and re-victimising the victim by placing them in the impossible position of choosing between paying a ransom to recover their business or violating sanctions,” he said.

At the same time, the UK Office of Financial Sanctions Implementation has published new public guidance to better explain the implications of sanctions against ransomware operators. Similar to how other sanctions work, making funds available to any of the named individuals through ransomware payments now becomes prohibited.