U.S. and Allies Sanction Cybercriminals and Russian State-Linked Hackers for Ransomware, Espionage, and Infrastructure Attacks The U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) has sanctioned two individuals and a VPN provider for facilitating ransomware attacks and other cybercriminal activities targeting Americans. First VPN Service (1VPNS), a VPN provider operational since 2014, was dismantled in May 2026 after a joint law enforcement operation by European and North American authorities. The service, along with its Ukrainian administrator Dmytro Rashevskyi (45), was accused of enabling ransomware groups to obscure attack origins, deploy malware, and exfiltrate data all while refusing to log user activity or cooperate with law enforcement. Rashevskyi allegedly used aliases, including "Maksim Sorin" and "Roman Chabanenko," to acquire infrastructure despite abuse complaints from internet service providers. A Belarusian national, Yegeniy Vladimirovich Silayev, was also sanctioned for selling cryptors that disguised ransomware as legitimate software to evade detection. Victims of attacks linked to 1VPNS included U.S. businesses, financial institutions, hospitals, and municipal governments, with officials estimating billions in losses to American entities. The sanctions coincide with U.K. and E.U. actions targeting Russian cyber networks for "persistent and reckless" operations aimed at destabilizing Europe. The measures include 24 individuals and entities tied to destructive cyber and hybrid threats, including senior members of Russia’s Main Intelligence Directorate (GRU) Vyacheslav Stafeyev, Ivan Senin, and Ivan Kasyanenko for directing cyber operations. The FSB’s Centre 16 was also implicated in sabotage attacks on Poland’s energy grid in late 2025. Additionally, the sanctions address Lumma Stealer, a malware tool used to harvest sensitive data at scale, which Russia has allegedly leveraged for cyber espionage. The E.U. condemned Russia’s misuse of cybercriminals, hacktivists, and private firms to conduct disruptive attacks on critical infrastructure, public services, and financial systems. Separately, the FBI issued an advisory warning of FSB Centre 16 actors exploiting poorly configured networking devices, particularly routers, to infiltrate critical infrastructure. The group scans for vulnerable devices using SNMP (Simple Network Management Protocol) with default credentials, then exfiltrates configurations to attacker-controlled servers. They also exploit known vulnerabilities in Cisco devices, including CVE-2018-0171 and CVE-2008-4128, the latter added to CISA’s Known Exploited Vulnerabilities (KEV) catalog with a federal patch deadline of July 16, 2026. The threat actors, tracked under names like Berserk Bear, Dragonfly, and Energetic Bear, have targeted sectors including defense, energy, healthcare, and government facilities. Cisco previously warned of active exploitation of CVE-2018-0171 in August 2025, urging immediate patching. The NSA confirmed the campaign’s ongoing impact across U.S. and international networks.

U.S. Treasury Imposes Sweeping Sanctions on Iranian Cyber Actors in "Operation Economic Outcast" The U.S. Department of the Treasury has unveiled a new wave of sanctions targeting Iranian cyber actors as part of Operation Economic Outcast, an aggressive campaign to dismantle the financial networks sustaining Iran’s regime and its Islamic Revolutionary Guard Corps (IRGC). Announced by Treasury Secretary Scott Bessent, the initiative aims to sever Iran’s economic lifelines, including those supporting its cyber operations, nuclear programs, missile development, and oil trade. At the center of the sanctions are nearly 60 Iran-linked entities, individuals, and vessels, with a particular focus on a cyber group tied to Iran’s Ministry of Intelligence and Security (MOIS). This group has been responsible for extensive breaches of U.S. critical infrastructure, including energy companies, defense contractors, healthcare institutions, and financial firms since late 2023. The Treasury alleges that while these actors conduct cyber espionage on behalf of MOIS, some prioritize personal financial gain, even targeting Iranian companies for profit. Five individuals from the Tehran-based Mabna Institute Keyvan Fayyaz Ghareh Blagh, Saber Shahbazi Balujeh, Mohammad Reza Kadkhoda'i, Mojtaba Ghal'eh-Kuhi, and Arman Kahzadian were indicted by the U.S. Justice Department for their roles in these operations. Their activities include data exfiltration from U.S. government offices in summer 2024 and cryptocurrency theft, with blockchain analytics firm TRM Labs estimating that the group has received nearly $17 million across 30 wallets since 2018. Keyvan Fayyaz Ghareh Blagh alone accounts for 92% of the network’s on-chain volume, while Arman Kahzadian is linked to a 2023 Bitcoin heist worth over $30,000. The sanctions also target Zedcex and Zedxion, two U.K.-based front companies accused of processing $1 billion in funds for the IRGC. TRM Labs describes the operation as an effort to isolate Iran’s regime both financially and in the digital assets space, warning that secondary sanctions will pressure global entities still engaging with Iran. In parallel, the U.S. State Department’s Rewards for Justice program is offering up to $10 million for information on foreign-directed cyber threats to critical infrastructure. Iranian cyber activities have escalated since February 2026, following U.S. and Israeli airstrikes, with attacks including the breach of FBI Director Kash Patel’s personal email and disruptions to over 30 U.S. water and wastewater utilities. Suspected Iranian hackers also caused a four-day shutdown of a small U.K. power plant last month, though officials assured no broader energy risks emerged. Security firm SentinelOne characterizes Iran’s cyber operations as a multi-pronged threat, blending data theft, destructive attacks, social engineering, and opportunistic targeting of exposed operational technology. Meanwhile, a decentralized network of pro-Iran hacktivist groups operating via Telegram and DDoS-for-hire tools has amplified propaganda and psychological pressure campaigns, often timed with kinetic military actions. While technically unsophisticated, these efforts leverage speed and visibility to shape narratives in Western media. The Treasury’s sanctions mark a significant escalation in the U.S. government’s efforts to counter Iran’s cyber and financial networks, signaling a broader strategy to isolate the regime through economic and digital means.

The Chinese state-sponsored hacking group Murky Panda (Silk Typhoon) exploited trusted cloud relationships and zero-day vulnerabilities to breach the U.S. Treasury’s Office of Foreign Assets Control (OFAC). By compromising a SaaS provider’s cloud environment, the attackers gained access to application registration secrets in Entra ID (formerly Azure AD), allowing them to authenticate as a legitimate service and infiltrate downstream networks. This enabled them to read sensitive emails, steal confidential government data, and maintain persistent access through backdoor accounts with escalated privileges.The attack leveraged supply chain vulnerabilities, abusing delegated administrative privileges (DAP) granted to cloud providers, which allowed Murky Panda to move laterally across multiple tenants. Their use of custom malware (CloudedHope RAT), web shells (Neo-reGeorg, China Chopper), and compromised SOHO devices as proxies ensured stealthy, long-term access while evading detection. The breach posed a severe risk to national security, given OFAC’s role in enforcing economic sanctions and combating financial threats. The attackers’ operational security (OPSEC) measures, including log tampering and timestamp manipulation, further obscured forensic traces, amplifying the threat’s sophistication and impact.

The breach of the US Treasury by Chinese hackers, including 12 individuals indicted by the Department of Justice, resulted in significant data compromise. Over a three-month period, at least 400 PCs were infiltrated leading to the theft of more than 3,000 files. This attack highlights the risk posed by autonomous state-sponsored hacking groups who target and steal sensitive information from high-profile international entities, selling it to government clients for strategic advantages.

The United States Treasury suffered a 'major' breach when an Advanced Persistent Threat group, believed to be linked to the Chinese government, exploited flaws in BeyondTrust software. The attackers stole an authentication key, gaining access to department computers and managing to steal 'certain unclassified documents'. While classified as unclassified, the breach's full extent and subsequent risks, such as exposure to financial manipulations and international diplomatic consequences, are still under assessment.

A breach in early December 2024 at the US Treasury Department involved remote access by hackers to Treasury computers, compromising certain unclassified documents. By exploiting vulnerabilities in remote support software from BeyondTrust, identified as CVE-2024-12356 and CVE-2024-12686, attackers stole an authentication key, enabling system access. Despite the breach being attributed to a Chinese state-sponsored APT actor, no ongoing access was found. The incident sparked collaborations with FBI, CISA, and intelligence agencies for a comprehensive evaluation.

Companies suffered as a result of hacking attacks against US federal entities, affected departments included the US Department of Homeland Security, the Department of Commerce, and the Department of the Treasury. Early this year, Iranian government-sponsored hackers, including the FBI and CISA, gained access to a network of an unnamed US federal agency and used the Log4Shell vulnerability to install crypto miners and use stolen passwords. According to the advisory, "Cyber threat actors advanced to the domain controller (DC), compromised credentials, implanted Ngrok reverse proxies on multiple hosts to maintain persistence, and then exploited the Log4Shell vulnerability in an unpatched VMware Horizon server to install XMRig crypto mining software.

Treasury Cancels Booz Allen Hamilton Contracts After Massive Tax Data Leak The U.S. Department of the Treasury announced on Monday the termination of all contracts with consulting firm Booz Allen Hamilton following a major breach involving the leak of sensitive tax information. The decision comes after former IRS contractor Charles Edward Littlejohn, who worked for Booz Allen, was sentenced in 2024 to five years in prison for disclosing confidential tax records including those of former President Donald Trump to media outlets. Between 2018 and 2020, Littlejohn provided stolen tax data to The New York Times and ProPublica, an act prosecutors described as "unparalleled in the IRS's history." The breach exposed records belonging to approximately 406,000 individuals, though the Treasury’s statement did not explicitly mention Trump’s leaked returns. Treasury Secretary Scott Bessent stated that the cancellation was necessary to "increase Americans' trust in government," citing Booz Allen’s failure to implement adequate safeguards for sensitive taxpayer data. The department had 31 active contracts with the firm, totaling $4.8 million in annual spending and $21 million in total obligations. Court documents revealed that Littlejohn intentionally sought the contractor role to access Trump’s tax returns, using his technical skills to extract data without detection. At his sentencing in January 2024, he acknowledged his actions, stating, "I used my skills to systematically violate the privacy of thousands of people." Booz Allen Hamilton has not yet commented on the termination.