The US has unleashed a new round of sanctions on nearly 60 individuals and entities, including those suspected of cyber intrusions, as part of a new campaign against Iran.
Operation Economic Outcast was announced on August 24 by treasury secretary, Scott Bessent, as a way to cut the financial flows sustaining Tehran.
As part of these efforts, the US sanctioned five individuals linked to the Mabna Institute, a private hacking-for-hire enterprise believed to have launched cyber-attacks for the Iranian regime for several years.
These five were among 17 members of Mabna Institute indicted by the Department of Justice (DoJ) on August 18 for their role in cyber-espionage campaigns.
The DoJ claimed that, since at least 2013, the 17 had carried out intrusions at 144 US-based universities, 178 foreign universities, at least 42 US-based private sector companies, 11 foreign private sector companies, five US federal and state government agencies, and at least two non-governmental organizations (NGOs).
Read more on the Mabna Institute: Iranian Threat Group Targets 380 Global Universities
The designations published by the Treasury’s Office of Foreign Assets Control (OFAC) listed 30 crypto addresses across Bitcoin, Ethereum, and TRON, belonging to four of the 17 defendants.
TRM Labs, a blockchain forensics company, explained in a blog post on August 24 that these addresses contain around $16.8m dating back to 2018.
Most ($15.5m) of the funds are found in 10 addresses linked to Keyvan Fayaz (aka Achilles, The Joker, and bc.monster), which suggests “he may have acted as a treasury of sorts for Mabna’s hacking-for-hire operations,” TRM Labs claimed.
Some $1.2m was linked to 15 addresses associated with Behzad Mesri.
“Addresses belonging to Behzad Mesri, the defendant separately charged with hacking HBO, show a pattern of layered transactions between his addresses, with hundreds of thousands ultimately funnelled to a deposit address at a large centralized exchange, likely to be cashed out – on-chain behavior commonly used to obfuscate source of funds,” TRM Labs continued.
More Work for Compliance Teams
Operation Economic Outcast also levies sanctions on entire sectors: digital assets, technology, gold, aviation and shipping.
“These determinations expand the categories of Iran-related conduct that may be subject to secondary sanctions, and they allow OFAC to sanction any person or entity providing services in support of five sectors of the Iranian economy,” TRM Labs warned.
“Under the new sectoral determination, any institution that processes a significant transaction for an Iranian exchange or digital assets business in turn risks its access to the US financial system.”
Cryptocurrency compliance teams will therefore need to screen out transactions from Iranian entities, to avoid being punished by the US government, the analytics firm noted.
“Additionally, compliance teams should be ready to screen for secondary sanctions risk, and flag incoming transactions from any wallets with exposure to Mabna Institute wallets,” it added.
