Loading story…
The U.S. Treasury designated the Russia-linked A7 Network a significant transnational criminal organization under Executive Order 13581, alleging that it enabled sanctions evasion and cross-border illicit finance, including activity connected to Iran. The action, part of Operation Economic Outcast, immediately blocks A7 property and interests in property under U.S. jurisdiction, as well as entities owned 50% or more by designated parties. Treasury said the network used foreign front companies, trade-finance documents and VPN-operated bank accounts to move funds, with alleged connections to the IRGC, Iran-backed terrorist groups, ransomware actors and North Korean cybercrime proceeds.
FinCEN separately found transactions involving non-U.S. companies controlled by A7—known as Sub-Agents—to be of primary money-laundering concern and proposed 31 CFR 1010.668. The measure would bar covered U.S. financial institutions from sending fiat currency or convertible virtual currency to or from designated Sub-Agents, whose identities would primarily be distributed through FinCEN's secure FI Portal. FinCEN estimated Sub-Agents processed more than $17 billion in dollar-denominated transactions between January 2025 and June 2026. Authorities also cited A7A5, a ruble-backed token issued by sanctioned Old Vector LLC on Tron and Ethereum, as an internal accounting mechanism associated with foreign-fiat payments; more than 180 entities processed at least $179.1 billion in A7A5 transactions during a similar period.
See the reporting duties and controls this puts on the clock.
9 events from the most recent confirmed update back to the earliest known activity.
FinCEN issued a finding that transactions involving non-U.S. companies controlled by A7 are a class of transactions of primary money laundering concern. It proposed 31 CFR 1010.668 to prohibit covered U.S. financial institutions from transmitting fiat currency or convertible virtual currency to or from identified A7 Sub-Agents.
OFAC designated the Russia-linked A7 Network as a Significant Transnational Criminal Organization under Executive Order 13581, alleging it facilitated Iranian sanctions evasion. The action requires U.S. persons to block covered A7 property and applies to entities owned 50% or more by blocked persons.
By June 2026, FinCEN assessed that A7 had created or acquired hundreds of controlled Sub-Agents with accounts at approximately 435 financial institutions across at least 83 countries.
Following the reported hack of Grinex, A7A5 supply consolidated into unhosted wallets. FinCEN said A7A5 activity had historically occurred mainly through the sanctioned Garantex and Grinex venues.
The United States imposed sanctions on A7 LLC, A7A5 issuer Old Vector LLC, and other businesses. The later October 2026 action expanded these measures to the broader A7 Network and its intermediaries.
The Russia-linked A7 Network was launched by Ilan Shor and Russia's state-owned defense bank Promsvyazbank. Its core Russia-based companies included A7 LLC, A71 LLC, and A7 Agent LLC.
More than 180 entities processed at least $179.1 billion in transactions involving the ruble-backed A7A5 token. FinCEN characterized the token as part of a mirror-payment system representing corresponding foreign fiat payments.
FinCEN assessed that A7-controlled foreign payment intermediaries, termed Sub-Agents, processed more than $17 billion in dollar-denominated transactions during this period.
A7 clients purchased more than 3,200 bills of exchange, or veksels, valued at more than $25 billion. FinCEN described the instruments as part of a system used to conceal Russian involvement in cross-border payments.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The UK imposed a new sanctions package targeting Russia’s sanctions-evasion infrastructure, naming 18 entities and individuals tied to crypto-enabled finance, the Kremlin-backed **A7 network**, and a Kyrgyz bank suspected of facilitating payments for Russia’s war economy. The measures also designated **Huobi Global S.A.**, the entity behind crypto exchange **HTX**, over allegations that it helped channel funds to Russia, alongside three Georgia-based companies operating Russia-focused exchanges and other actors linked to illicit financial flows. Subsequent blockchain analysis said HTX continued operating under the same brand after the designation while rapidly rotating hot wallets and funding addresses across **TRON**, **Ethereum**, **BNB Smart Chain**, and **Solana**, complicating sanctions screening based on static wallet blocklists. The reporting tied the action to alleged support for **A7 LLC** and **Garantex** and to the UK National Crime Agency-led **Operation Destabilize**, underscoring compliance risks for firms that rely only on fixed address lists rather than behavior-based attribution and enhanced due diligence.
Jul 24, 2026
The U.S. Treasury launched **Operation Economic Outcast**, a sweeping sanctions campaign targeting the Iranian regime and its support network, designating nearly 60 entities, individuals, and vessels and issuing five sectoral sanctions determinations under Executive Order `13902`. Treasury also explicitly identified **digital assets** as a sanctionable Iranian sector, a move that raises secondary-sanctions exposure for exchanges and other firms that facilitate significant transactions involving Iranian digital asset businesses. A key cyber component of the action targeted five individuals tied to the Iran-based **Mabna Institute**, whose members were also charged by the U.S. Department of Justice for an alleged long-running hacking-for-hire operation conducted on behalf of the **IRGC** and other Iranian clients. OFAC published 30 cryptocurrency addresses linked to four Mabna defendants across **Bitcoin, Ethereum, and TRON**; blockchain analysis cited in reporting said the addresses received about **$16.8 million** since 2018, with roughly **92%** of the volume concentrated in wallets attributed to **Keyvan Fayaz**.
Aug 25, 2026
New reporting highlighted the growing role of **cryptocurrency in sanctions evasion and illicit finance**, with 2025 seeing a sharp increase in value received by sanctioned entities and record illicit transaction volume. Chainalysis reported a **694% surge** in value received by sanctioned entities and described nation-state integration of crypto into national financial infrastructure, including **Iranian state-linked activity** (with **IRGC/proxy networks** accounting for over half of value received in Q4 2025) and Russia-linked sanctions workarounds such as the **ruble-backed A7A5 stablecoin**, which processed **$93.3B** in under a year. The same reporting noted sanctions against exchanges **Grinex** and **Meer** for facilitating A7A5-related activity, and assessed that **North Korea stole over $2B in crypto in 2025**, with proceeds reportedly supporting the regime’s **WMD program**; it also pointed to sanctions targeting Southeast Asian scam facilitators tied to “**pig butchering**” operations. Separate analysis of Iran’s crypto ecosystem described **Nobitex** as a major on/off-ramp with **>$5B** in observed volume since 2025 and extensive exposure to sanctioned and high-risk counterparties. TRM Labs said post–Feb. 28 US-Israeli strikes activity (including **>$35M** moved to cold storage) appeared consistent with operational liquidity management rather than user capital flight, and it detailed how a **June 2025 breach (~$90M loss)** revealed a multi-tier custody architecture (hot/warm/cold wallets) and controls for high-value or politically connected clients, alongside structures intended to mitigate sanctions constraints; TRM also observed **~$2.7M** consolidated from dormant mining-linked wallets after the breach, suggesting reserve mobilization to restore liquidity. Other items in the set—an Europol-backed takedown of a gambling-fraud money-laundering ring exploiting Ukrainian women and a US guilty plea by an alleged **Phobos ransomware** administrator—concern cyber-enabled crime but do not materially address the same crypto-sanctions focus, while a TRM post about legislative testimony is primarily an event write-up rather than incident-specific intelligence.
Jun 29, 2026