US Department of the Treasury Sanctions Cybercrime Enablers in Ongoing Ransomware Crackdown

Key Takeaways

• OFAC sanctioned individuals tied to VPN and cryptor services used by ransomware groups
• Broader trends show declining ransom payments but rising operational and recovery costs
• Multiple global incidents highlight how rapidly attackers adapt through AI tools and multi-extortion tactics

The latest sanctions issued by the U.S. Department of the Treasury’s Office of Foreign Assets Control landed at a moment when ransomware groups are actively rethinking their business models. Even as payments fall, attackers continue to probe for ways to maintain leverage. The sanctions target the operator of First VPN Service and a developer who allegedly provided cryptors that helped disguise malware from security tools. According to U.S. officials, their services enabled ransomware operators to hide infrastructure, deploy payloads, and manage stolen data. First VPN Service was dismantled in a multinational operation in May.

While enforcement actions aim to disrupt supply chains, the broader ransomware economy is shifting in ways that complicate the picture. Recent analysis shows extortion payments fell sharply in 2024, dropping to about $813.5 million according to Chainalysis reporting, aggregated in coverage by Wired. Yet the number of reported ransomware claims continued its upward climb. Analyst1 found 5,223 claims in 2024, with nearly 51% occurring in the United States. That concentration makes sanctions a relevant policy tool, although they represent just one part of the equation.

The industry is also watching how ransomware operators experiment with automation. ReliaQuest pointed to The Gentlemen group using artificial intelligence to accelerate tooling updates and attract new affiliates. For business leaders trying to understand the direction of threat activity, this indicates that attackers are treating operational efficiency much the way a legitimate software vendor might.

On the financial side, Coveware data cited by Rapid7 reinforces that paid ransoms are not always in line with the dramatic figures often posted on leak sites. The average ransom payment in Q3 2024 was about $479,237, with a median of $200,000. These amounts matter for insurers and risk managers, especially because the average overall cost of a successful attack was estimated at $10.2 million in the CSNP 2024 analysis. Recovery and downtime remain the largest drivers of financial loss.

Not everything in this week’s roundup focused on ransomware. Retail fraud and entertainment scams surfaced again when Group-IB identified a coordinated scheme targeting Celine Dion fans seeking tickets for upcoming Paris concerts. Attackers created cloned versions of Ticketmaster, AXS, the artist’s official site, and Paris La Défense Arena, then lured victims through social engineering on Facebook. It fits a pattern analysts at Gartner have described, where criminal groups blend traditional phishing with consumer-grade design tactics to boost conversion rates. The reuse of phishing kits across events stands out, a tactic Forrester has noted in its guidance on fraud rings that pivot quickly between high-demand targets.

Elsewhere, large-scale data breach consequences continued to unfold. Genetic testing firm 23andMe, now operating as Chrome Holding, agreed to pay $18 million to settle allegations by 43 state attorneys general over security failures tied to the 2023 breach. Nearly 7 million individuals were affected, and the settlement comes shortly after a separate $46.75 million agreement involving credential-stuffing victims. Regulatory oversight in this space tends to echo NIST’s Cybersecurity Framework guidance around access controls and monitoring. The case also illustrates how delayed detection can complicate both legal exposure and incident response.

On the espionage front, Symantec found that Backdoor.Daxin, a China-linked kernel-mode rootkit, may have lingered inside a Taiwan-based subsidiary of a high-tech manufacturer for as long as 13 years. The same system hosted a new backdoor known as Stupig, which shared characteristics with Daxin. These kinds of long-dwell-time infections underscore why federal agencies such as CISA continue urging adoption of controls described in the StopRansomware guidance. Persistent footholds allow attackers to pivot, hide, and build deeper access channels over time.

Meanwhile, Microsoft issued patches for multiple vulnerabilities as part of its recent Patch Tuesday release, including flaws affecting SharePoint Server. CISA quickly followed with an alert ordering rapid SharePoint patching, setting strict remediation deadlines for federal agencies. The cadence of these advisories mirrors observations by IDC that enterprise platforms with large deployments attract attackers looking for high-impact access routes. SharePoint’s authentication pathways have been of particular interest in recent incident forensics work.

Spanish law enforcement also announced the dismantling of a cybercrime ring that allegedly stole around €140 million through investment scams and business email compromise attacks. Investigators traced activity across more than 800 bank accounts and dozens of money mules. These cases continue to highlight how financially motivated groups treat fraud as an international supply chain with distributed operators and rapid money-movement tactics.

Finally, the Argentine Football Association disclosed that one of its official email accounts had been compromised and used to distribute fraudulent messages about the national team’s World Cup victory. The incident may have stemmed from leaked credentials on an Egyptian forum. While seemingly small in scale, episodes like this tend to ripple across public-facing organizations, which often struggle with high-volume credential reuse.

Taken together, the week’s activity paints a picture of threat actors shifting tactics while defenders work through a mix of enforcement actions, regulatory outcomes, and rapid patch cycles. The sanctions fit into a broader effort to disrupt the infrastructure behind ransomware operations, but the surrounding incidents show that attackers adapt quickly. Businesses tracking these developments benefit from returning to the basics outlined in the NIST Cybersecurity Framework and the practical steps in CISA’s StopRansomware guidance, both of which emphasize visibility, incident preparedness, and authentication hygiene.