OFAC - Office of Foreign Assets Control

The Office of Foreign Assets Control (OFAC) is the agency within the U.S. Department of the Treasury that administers and enforces U.S. economic and trade sanctions. In the cyber incident response context, OFAC is most relevant when an organization considers paying a ransom: paying a ransom to a sanctioned person or jurisdiction, even unwittingly, can violate U.S. law and result in penalties under strict-liability standards.

The OFAC Ransomware Advisory

OFAC's updated ransomware advisory (most recently September 2021) warns that companies, financial institutions, cyber insurance firms, DFIR firms, and others involved in facilitating ransomware payments may face civil penalties under the strict-liability standards of the International Emergency Economic Powers Act (IEEPA) and the Trading with the Enemy Act (TWEA), even if they did not know the payment recipient was sanctioned.

Mitigating Factors

OFAC's advisory identifies mitigating factors that may reduce the likelihood of enforcement action:

• Full and timely cooperation with law enforcement, particularly FBI and CISA
• Self-initiated, timely report of the incident to OFAC and law enforcement
• Implementation of meaningful steps to remediate the underlying compromise
• Existence of a sanctions compliance program with sanctions screening before payment
• Pre-incident due diligence on cyber insurance and incident response vendors

OFAC Sanctions and Ransomware Actors

OFAC has sanctioned a growing list of ransomware actors and facilitators, including specific persons associated with REvil, Trickbot, Conti, and others; cryptocurrency mixing services (Tornado Cash, Sinbad); and exchanges (SUEX, Chatex, Garantex). The OFAC SDN (Specially Designated Nationals) list is updated continuously and must be checked before any ransom payment.