Several Iranian nationals and their bitcoin addresses have been sanctioned, according to an update from the US Treasury Department. An official publication mentions Ahmad Khatibi Aghada, Amir Hossein Nikaeen and at least seven addresses under their control.
An indictment filed in the U.S. District Court of New Jersey charged these individuals and Ahmadi Mansour with conspiring to commit computer fraud and related activities, willfully damaging a protected computer, and seeking monetary compensation in Bitcoin.
BTC price is moving sideways on the 4-hour chart. Source: BTCUSDT trade view
The document was released today by the US Department of Justice (DoJ) and alleges that these hackers were allegedly engaged in illegal cyber activities as of October 2020. Nikaeen and his co-conspirators attacked from Iran and allegedly took over computers in the United States, Britain, Israel, Russia and others.
The hackers allegedly used “known vulnerabilities in commonly used network devices and software applications” to carry out their exploits. Additionally, they used Microsoft’s BitLocker to encrypt their victims’ computers and demand payment in Bitcoin before relinquishing control.
In a Microsoft report released in early September, the big tech company acknowledged these attacks and linked a large portion to a hacking group called “Nemesis Kitten” and its Iranian chapter called DEV-0270 or “PHOSPHORUS”. The report claims that these “widespread” attacks are sponsored by the Iranian government.
The indictment makes no mention of any connection between the suspects and “PHOSPHORUS,” but they appeared to be operating on a similar plan. The hacker group demanded that the victim pay up to $8,000 to unlock the computer. If the victim refuses, they sell the stolen data on the internet.
According to Microsoft, using BitLocker via malicious commands renders the victim’s computer unusable:
DEV-0270 has been observed using setup.bat commands to enable BitLocker encryption, causing hosts to become inoperable.
Treasury Sanctions Bitcoin Addresses, What’s the Impact?
The indictment alleges that the Iranian hackers were allegedly able to affect small businesses, government agencies, non-profit programs, educational and religious institutions, and several critical infrastructure sectors such as hospitals and transportation services.
The hackers often set up websites using the name format of legitimate technology companies to lure the victims. Once gaining access to the computers, hackers demanded payment in bitcoin and other cryptocurrencies by providing an email address, as seen below.
Message from hackers to their victims, detailed in the indictment. Source: US DOJ
Authorities in the USA were able to link the hackers via their Bitcoin addresses. The bad actors used the same addresses when demanding payment from their victims.
In the past, law enforcement agencies have been able to track down stolen funds and criminals through their BTC transactions. Given the transparency of the BTC network, some authorities believe that Bitcoin can be a tool to prevent criminal activity.
U.S. Attorney for New Jersey Philip Sallinger said the following about the case:
By indicting them in this indictment, by publicly naming them, we are stripping them of their anonymity. You can no longer operate anonymously from the shadows. We put them in the spotlight as wanted criminals.
The US Treasury Department sanctions have been the subject of controversy in the crypto space. A few weeks ago, the institution sanctioned Ethereum-based decentralized exchange Tornado Cash in an act that many experts considered “trespassing.”
This was the first time the institution sanctioned a neutral technology. Now the Treasury Department has released instructions for people to “safely” remove their funds from the exchange, acknowledging that some people were impacted by interacting with the addresses linked to Tornado Cash. What will happen to the people who interact with the bitcoin addresses sanctioned today?
Learn Crypto Trading, Yield Farms, Income strategies and more at CrytoAnswers
https://nov.link/cryptoanswers
Comments are closed.