US Sanctions Suex to Disrupt Ransomware Cash-Out Networks

The U.S. Treasury sanctioned Russia-based cryptocurrency OTC broker Suex and added it to the SDN List, barring U.S. persons from transacting with the firm as Washington intensified efforts to disrupt ransomware financing. Treasury said Suex facilitated illicit transactions for at least eight ransomware variants and was used to launder proceeds from ransomware, scams, darknet markets, and activity linked to BTC-e. Chainalysis reported that Suex had received more than $481 million in Bitcoin since 2018, including over $160 million tied to criminal sources, and described the broker as a nested service that converted cryptocurrency to cash through operations in Moscow and St. Petersburg.

The designation came alongside updated U.S. ransomware guidance and reflected a broader strategy of targeting the financial infrastructure behind attacks rather than only the malware brands, which frequently rebrand or share affiliates and laundering channels. Blockchain-tracing firms and law enforcement had already shown how ransomware groups such as DarkSide, Maze, Egregor, and DoppelPaymer relied on common cash-out pathways, while the DOJ separately recovered 63.7 BTC from the Colonial Pipeline ransom and later monitoring showed DarkSide-linked funds moving through laundering patterns toward exchanges. The action underscored that ransomware-as-a-service operations depend on OTC brokers, exchanges, and service deposit addresses to turn extortion payments into usable cash.