Beautiful Virgin Islands

Thursday, May 14, 2026

Seven Russians sanctioned over ransomware cyber-crime

Seven Russians sanctioned over ransomware cyber-crime

Seven Russian men have been sanctioned by the UK and US for having links to recent ransomware attacks.

The UK's Foreign Office, along with US authorities, has released pictures of the men, frozen their assets and imposed travel restrictions.

US authorities have accused them of being members of loosely defined Russian-based hacking network Trickbot.

Ransomware strains Conti and Ryuk extorted at least £27m in ransoms from 149 British victims.

"This is a hugely significant moment for the UK and our collaborative efforts with the US to disrupt international cyber-criminals," said National Crime Agency director general Graeme Biggar.

"The sanctions are the first of their kind for the UK and signal the continuing campaign targeting those responsible for some of the most sophisticated and damaging ransomware that has impacted the UK and our allies," he said.

Mikhail Iskritskiy also known as (aka) Tropa and Valery Sedletski aka Strix are on the new cyber sanctions list

The National Cyber Security Centre, a part of GCHQ, has assessed that key group members are "highly likely" to have strong links to the Russian Intelligence Services from which they are sometimes directed.

No evidence was supplied to support this allegation.

The UK government categorises ransomware as a tier one national security threat with recent victims including UK schools, local authorities and firms.

The individuals sanctioned are: Vitaliy Kovalev, Valery Sedletski, Valentin Karyagin, Maksim Mikhailov, Dmitry Pleshevskiy, Mikhail Iskritskiy and Ivan Vakhromeyev.

Any arrests are impossible unless the accused leave the country.

The group behind the Conti strain has targeted hospitals, schools, businesses and local authorities, including the Scottish Environment Protection Agency.  It extorted $180m (£148m) in ransomware in 2021 alone, according to research from Chainalysis.

Ireland's Health Service Executive was targeted by Conti ransomware actors during the Covid pandemic, leading to disruption to blood tests, X-rays, CT scans, radiotherapy and chemotherapy appointments over 10 days. 

Another recent ransomware attack included Harrogate-based transportation and cold storage firm Reed Boardall, whose IT systems were under attack for nearly a week in 2021.

Although Conti disbanded in 2022, its members are thought to have continued their attacks under different guises.

Russia has for years denied that it is harbouring ransomware hackers, but cyber-security experts say there is compelling evidence that many of the criminal groups are co-ordinated from the country.

Many of the gangs operate on Russian-language forums, there are fewer attacks on Russian organisations, and the frequency of hacks dips during Russian public holidays.

The latest sanctions follow multinational efforts to disrupt ransomware crews, most recently by sabotaging the Hive ransomware crew and taking them offline.

Previously the US and UK worked together on sanctions issued against alleged members of cyber-crime group Evil Corp in 2020. Authorities allege that some of the men in the latest sanctions could have formerly worked for the group.

In 2021 the BBC went to Russia to try to track down the group and was told by a family member that the sanctions had made them fear for their safety.


Businesses are being held to ransom by callous Ryuk cyber-criminals


Newsletter

Related Articles

Beautiful Virgin Islands
0:00
0:00
Close
The Great Western Exit: Why Best Citizens Are Fleeing the Rich World [PODCAST]
The New Robber Barons of Intelligence: Are AI Bosses More Powerful Than Rockefeller?
The End of the Old Order [Podcast]
Britain’s Democracy Is Now a Costume
The AI Gold Rush Is Coming for America’s Last Open Spaces [Podcast]
The Pentagon’s AI Squeeze: Eight Tech Giants Get In, Anthropic Gets Shut Out [Podcast]
The War Map: Professor Jiang’s Dark Theory of Iran, Trump, China, Russia, Israel, and the Coming Global Shock [Podcast]
Labour Is No Longer a National Party [Podcast]
AI Isn’t Stealing Your Job. It’s Dismantling It Piece by Piece.
Lawyers vs Engineers: Why China Builds While America Litigates [Podcast]
Churchill’s Glass: The Drunk, the Doctor, and the Myth Britain Refuses to Sober Up From
Apple issues an unusual warning: this is how your iPhone can be hacked without you doing anything
The Met Gala Meets the Age of Billionaire Backlash
Russian Oligarch’s Superyacht Crosses Hormuz via Iran-Controlled Route
Gunfire Disrupts White House Correspondents’ Dinner as Trump Is Evacuated
A Leak, a King, and a Fracturing Alliance
Inside the Gates Foundation Turmoil: Layoffs, Scrutiny, and the Cost of Reputational Risk
UK Biobank Breach Exposes Health Data of 500,000, Listed for Sale on Chinese Platform
KPMG Cuts Around 10% of US Audit Partners After Failed Exit Push
French Police Probe Suspected Weather-Data Tampering After Unusual Polymarket Bets on Paris Temperatures
News Roundup
Microsoft lost 2.5 millions users (French government) to Linux
Privacy Problems in Microsoft Windows OS
News roundup
Péter András Magyar and the Strategic Reset of Hungary
Hungary After the Landslide — A Strategic Reset in Europe
×