US sanctions Russian who laundered money for Ryuk ransomware affiliate

The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) has sanctioned Russian national Ekaterina Zhdanova for laundering millions in cryptocurrency for various individuals, including ransomware actors.

Zhdanova used her expertise in cryptocurrency and blockchain networks to move money through various platforms such as Garantex (sanctioned in April 2022 for aiding the Hydra Market) to evade “Anti-Money Laundering/Combating the Financing of Terrorism” (AML/CFT) controls.

A report from blockchain analysis firm Chainalisys provided additional information about Zhdanova’s public businesses, which may or may not be part of her intricate money laundering schemes.

Wiz

Both OFAC and Chainalysis note that Zhdanova also leveraged her connections to an extensive global network of other money launderers to further obscure her financial activities activities and access a more traditional clientele.

Zhdanova's money-moving activity
Zhdanova's money-moving activity (Chainalysis)

Helping Ryuk ransomware affiliate

Zhdanova is also believed to have laundered over $2,300,000 of suspected ransom payments made to one affiliate of the Ryuk ransomware operation.

The Ryuk gang was active between 2018 and 2021 and went rampant with attacks on organizations in any sector, including healthcare during the pandemic, and extorting victims for the highest amount possible.

Ransom laundering process
Ransom laundering process (Chainalysis)

Zhdanova's system to hide the illegal origin of the Ryuk affiliate's money involved a fraudulently opened investment account and making real estate purchases.

Interestingly, another Russian citizen who laundered money for the Ryuk ransomware gang for three years was extradited from the Netherlands and recently pleaded guilty in the U.S.

Apart from ransomware, Zhdanova also assisted Russian oligarchs in evading sanctions imposed by the Western world in response to Russia’s invasion of Ukraine.

In one case, she facilitated the transfer of over $100 million on behalf of a Russian oligarch to the United Arab Emirates. Authorities have also confirmed several cases where she arranged for Russian clients to obtain UAE tax residency, ID cards, and bank accounts.

As a result of the OFAC sanctions, Ekaterina Zhdanova will have all her U.S.-based assets frozen, while U.S. persons and entities will be prohibited from engaging in any transactions with her.

Automated Pentesting Covers Only 1 of 6 Surfaces.

Automated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the other.

This whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic questions for any tool evaluation.

Related Articles:

Manager of botnet used in ransomware attacks gets 2 years in prison

Yanluowang ransomware access broker gets 81 months in prison

Phobos ransomware admin pleads guilty to wire fraud conspiracy

US sanctions Russian broker for buying stolen zero-day exploits

Microsoft links Medusa ransomware affiliate to zero-day attacks