The US Department of the Treasury’s Office of Foreign Assets Control (OFAC) has sanctioned Alexander Ermakov for the 2022 ransomware attack against Medibank Private Limited, an Australian insurer. The US worked in concert with Australia and the United Kingdom on the designation. Ermakov is believed to be linked to the Russia-backed cybercrime gang REvil.
Australia announced yesterday that it had sanctioned Ermakov for utilizing ransomware to attack the Medibank network and for the exfiltration of sensitive data of 9.7 million users of Medibank services.
Treasury said that all property and interests of property of Ermakov that are in the United States or in the possession or control of US persons must be blocked and reported to OFAC.
Under Secretary of the Treasury Brian E. Nelson commented on the sanctioning of Ermakov:
“Russian cyber actors continue to wage disruptive ransomware attacks against the United States and allied countries, targeting our businesses, including critical infrastructure, to steal sensitive data. Today’s trilateral action with Australia and the United Kingdom, the first such coordinated action, underscores our collective resolve to hold these criminals to account.”