Treasury Targets Sanctions Evasion Networks and Russian Technology Companies Enabling Putin’s War
Treasury also expands sanctions authorities to include aerospace, marine, and electronics sectors
WASHINGTON — Today, the Department of the Treasury’s Office of Foreign Assets Control (OFAC) is continuing to impose severe costs on the Russian Federation for its unprovoked and unjustified war against Ukraine by targeting operators in the Russian technology sector to prevent it from evading unprecedented multilateral sanctions and procure critical western technology. OFAC is designating 21 entities and 13 individuals as part of its crackdown on the Kremlin’s sanctions evasion networks and technology companies, which are instrumental to the Russian Federation’s war machine. Treasury has also determined that three new sectors of the Russian Federation economy are subject to sanctions pursuant to Executive Order 14024 (E.O. 14024). This allows Treasury impose sanctions on any individual or entity determined to operate or have operated in any of those sectors. Today’s sanctions are a part of the Administration’s comprehensive response to Russia’s to restrict their access to resources, sectors of their economy that are essential to supplying and financing the continued invasion of Ukraine.
“Russia not only continues to violate the sovereignty of Ukraine with its unprovoked aggression but also has escalated its attacks striking civilians and population centers,” said Secretary of the Treasury Janet L. Yellen. “We will continue to target Putin’s war machine with sanctions from every angle, until this senseless war of choice is over.”
One of the technology companies designated today exports more than 50 percent of Russian microelectronics and is Russia’s largest chipmaker. This follows OFAC’s March 24 designation of dozens of companies in Russia’s defense-industrial base that are directly supporting Putin’s unjustified war against the people of Ukraine. Treasury took today’s action in close coordination with our partners who are similarly committed to ensuring the Russian Federation is not exploiting their jurisdictions for its destructive aims.
Additionally, today OFAC is designating Russian government malicious cyber actors. The United States will continue to hold Putin’s cyber actors accountable for destructive, disruptive or otherwise destabilizing cyber activity targeting the United States and its allies and partners.
Today’s actions demonstrate the U.S. government’s commitment to countering the evasion of sanctions that the United States and our allies and partners have put in place to impose unprecedented costs on the Russian Federation for its aggression against Ukraine. The Treasury Department will use all authorities at its disposal to enforce sanctions against the Russian government and its proxies.
RUSSIAN SANCTIONS EVASION NETWORKS
Moscow-based OOO Serniya Engineering (Serniya) is at the center of a procurement network engaged in proliferation activities at the direction of Russian Intelligence Services. This network operates across multiple countries to obfuscate the Russian military and intelligence agency end-users that rely on critical western technology. Serniya and Moscow-based OOO Sertal (Sertal) work to illicitly procure dual-use equipment and technology for Russia’s defense sector. Russia-based OOO Robin Treid, United Kingdom-based Majory LLP, United Kingdom-based Photon Pro LLP, and Spain-based Invention Bridge SL are front companies utilized by Serniya to facilitate its procurement of key equipment for the Government of the Russian Federation (GoR). Within the past month, the European Union and Japan have placed export-related restrictions on Serniya, Sertal, and Photon Pro. The UK is also taking coordinated action on the companies within its jurisdiction.
OFAC is designating Serniya, Sertal, Majory LLP, Photon Pro LLP, and OOO Robin Treid pursuant to Executive Order (E.O.) 14024 for being owned or controlled by, or having acted or purporting to act for or on behalf of, directly or indirectly, the GoR. OFAC is designating Invention Bridge SL pursuant to E.O. 14024 for being owned or controlled by, or having acted or purported to act for or on behalf of, directly or indirectly, Serniya.
Singapore-based Alexsong Pte Ltd facilitated transactions in support of sanctions evasion by the Serniya network. OFAC is designating Alexsong Pte Ltd pursuant to E.O. 14024 for being owned or controlled by, or having acted or purported to act for or on behalf of, directly or indirectly, the GoR.
To evade sanctions and carry out their procurement of sensitive technology, Serniya and Sertal employed a network of individuals to structure transactions and deceive counterparties. These individuals, who are being designated pursuant to E.O. 14024 for having acted or purported to act for or on behalf of, directly or indirectly, Serniya, include Irina Viktorovna Nikolaeva, Yevgeniya Aleksandrovna Podgornova, Sergey Aleksandrovich Yershov, Anton Alekseevich Krugovov, Andrey Georgiyevich Zakharov, and Yevgeniy Aleksandrovich Grinin.
OFAC is also designating, pursuant to E.O. 14024, Sergey Aleksandrovich Yershov and Viacheslav Yuryevich Dubrovinskiy for being leaders, officials, senior executive officers, or members of the board of directors of Serniya, an entity whose property and interests in property are blocked pursuant to this order. Sergey Aleksandrovich Yershov is also being designated pursuant to E.O. 14024 for having acted or purported to act for or on behalf of, directly or indirectly, Sertal a person whose property and interests in property are blocked pursuant to E.O. 14024. Pursuant to E.O. 14024, OFAC is also designating Anton Alekseevich Krugovov for being a senior executive officer of Majory LLP, a person whose property and interests in property are blocked pursuant to E.O. 14024. Pursuant to E.O. 14024, OFAC is also designating Yevgeniy Aleksandrovich Grinin for being a leader, official, senior executive officer, or member of the board of directors of Photon Pro LLP, a person whose property and interests in property are blocked pursuant to E.O. 14024.
OFAC is designating Tamara Aleksandrovna Topchi pursuant to E.O. 14024 for being a leader, official, senior executive officer, or member of the board of directors of Invention Bridge SL, a person whose property and interests in property are blocked pursuant to E.O. 14024.
OFAC is designating Russia-based OOO Nauchno-Tekhnicheskii Tsentr Metrotek and OOO Pamkin Khaus pursuant to E.O. 14024 for being owned or controlled by, or having acted or purporting to act for or on behalf of, directly or indirectly, Andrey Georgiyevich Zakharov, a person whose property and interests in property are blocked pursuant to E.O. 14024. OFAC is designating Russia-based OOO Foton Pro for being owned or controlled by, or having acted or purporting to act for or on behalf of, directly or indirectly, Yevgeniy Aleksandrovich Grinin, a person whose property and interests in property are blocked pursuant to E.O. 14024.
Evgeniya Vladimirovna Bernova (Bernova), an associate of the Serniya network, operates Malta-based Malberg Ltd (Malberg) though a multinational web of shell companies. Malberg has worked to deceptively acquire dual-use equipment on behalf of Russian end-users. Bernova’s network includes Malberg’s Director, Nikita Aleksandrovich Sobolev, UK-based Djeco Group LP, Malta-based Djeco Group Holding Ltd, Malta-based Maltarent Ltd, and France-based SCI Griber. In addition, Moscow-based Sernia-Film Co Ltd, where Bernova has served as a director, has facilitated the export of equipment by Malberg to intended government end-users in Russia.
OFAC is designating Malberg pursuant to E.O. 14024 for being owned or controlled by, or having acted or purporting to act for or on behalf of, directly or indirectly, the GoR. OFAC is designating Bernova for being owned or controlled by, or having acted or purporting to act for or on behalf of, directly or indirectly, the GoR, Bernova and Nikita Aleksandrovich Sobolev for being leaders, officials, senior executive officers, or members of the board of directors of Malberg, a person whose property and interests in property are blocked pursuant to E.O. 14024. OFAC is designating Djeco Group LP, Djeco Group Holding, Maltarent Ltd, and SCI Griber for being owned or controlled by, or having acted or purporting to act for or on behalf of, directly or indirectly, Bernova. OFAC is designating Sernia-Film Co Ltd for having materially assisted, sponsored, or provided financial, material, or technological support for, or goods or services to or in support of Malberg, a person whose property and interests in property are blocked pursuant to E.O. 14024.
Additionally, on September 23, 2020, Nikita Gennadievitch Kovalevskij (Kovalevskij) was designated by Treasury pursuant to E.O. 13694, as amended by E.O. 13757, for having acted or purporting to act for or on behalf of, directly or indirectly, Optima Freight OY (Optima). Optima is a Finland-based freight forwarding company that was evading U.S. sanctions by procuring underwater dive equipment for a company called Divetechnoservices (DTS). DTS was designated in 2018 pursuant to E.O. 13694, as amended by E.O. 13757, for procuring underwater equipment and diving systems for the Russian Federal Security Service (FSB). In 2020, Kovalevskij registered a new front company, Quantlog OY (Quantlog), in Finland in order to evade U.S. sanctions and continue his illicit procurement activities. Quantlog is being designated pursuant to E.O. 13694, as amended by E.O. 13757, for being owned or controlled by, or having acted or purporting to act for or on behalf of, directly or indirectly, Kovalevskij.
RUSSIAN COMPANIES IN THE TECHNOLOGY SECTOR
As demonstrated by the complex procurement efforts referenced above, the Russian military is reliant on key Western technologies for its defense-industrial base to function. In addition to continuing to target Russian sanctions evasion networks, OFAC is also targeting key Russian technology companies that are enabling Putin’s illegal war against Ukraine. These designations will further impede Russia’s access to western technology and the international financial system.
AO NII-Vektor is a Saint Petersburg, Russia-based software and communications technology company that has produced technical analysis and reports in support of the production stage of Liana constellation satellites for the Russian Federation. Liana constellation is Electronic Intelligence (ELINT) capability which has likely been used to track ships, aircraft, and ground vehicles during Russian’s illegal invasion of Ukraine. AO NII-Vektor is being designated pursuant to E.O. 14024 for operating or having operated in the technology sector of the Russian Federation economy.
T-Platforms is a Moscow, Russia-based company operating in the computer hardware sector. T-Platforms claims to be in the Russian supercomputer industry and the leading domestic developer of original computing equipment for the mass information technology market. T Platforms was considered the Russian high-performance computing activity leader circa 2012 and was tasked with implementing a supercomputer center for the Russian defense industry. T Platforms is being designated pursuant to E.O. 14024 for operating or having operated in the technology sector of the Russian Federation economy.
Joint Stock Company Mikron (Mikron) is the largest Russian manufacturer and exporter of microelectronics. In fact, Mikron is responsible for exporting more than 50 percent of Russian microelectronics. The company additionally manufactures integrated circuits, electronic components, and is Russia’s largest chipmaker. As one example of Mikron’s work, the company received tax benefits to produce the domestic chip for Russia’s National Payment Card System, also known as Mir. The Mir payment card system was developed following previous sanctions on Russia. Mikron is being designated pursuant to E.O. 14024 for operating or having operated in the technology sector of the Russian Federation economy.
Molecular Electronics Research Institute (MERI) is a research institute that manufactures computers, search and navigation equipment, and conducts research and development. Specifically, MERI conducts research and design work for various federal agencies of the GoR. MERI is being designated pursuant to E.O. 14024 for operating or having operated in the technology sector of the Russian Federation economy.
TREASURY EXPANDS RUSSIA SANCTIONS AUTHORITIES
In addition to the sanctions imposed on Russian actors today, Treasury is also enhancing and expanding its Russia sanctions authorities. Today, the Secretary of the Treasury, in consultation with the Secretary of State, determined that sanctions apply to the aerospace, marine, and electronics sectors of the Russian Federation economy pursuant to section 1(a)(i) of Executive Order (E.O.) 14024. This determination allows for sanctions to be imposed on any individual or entity determined to operate or have operated in any of those sectors and provides an expanded ability to swiftly impose additional economic costs on Russia for its war of choice in Ukraine. This action builds on previous determinations with respect to the financial services, technology, and defense and related materiel sectors of the Russian Federation economy. Today’s newly identified sectors align with recent actions taken by the U.S. Department of Commerce targeting these sectors, which are strategically important to Russia’s economic ambitions, long-term technological development, and defense industrial base.
TSNIIKHM TRITON MALWARE HACKER AND LEADERSHIP
The State Research Center of the Russian Federation (FGUP) Central Scientific Research Institute of Chemistry and Mechanics (TsNIIKhM) was responsible for building a customized tool that enabled the August 2017 cyber attack on a Middle East petrochemical facility. TsNIIKhM developed the Triton malware, also known as TRISIS and HatMan, specifically to target and manipulate ICS that are used in some critical infrastructure facilities. TsNIIKhM deployed the malware through phishing that targeted the petrochemical facility. During the cyber attack, the facility automatically shut down after several of the ICS controllers entered into a failed state, preventing the malware’s full functionality from being deployed.
OFAC designated TsNIIKhM on October 23, 2020, pursuant to Section 224(a)(1)(A) of the Countering America’s Adversaries Through Sanctions Act (CAATSA) for knowingly engaging in significant activities undermining cybersecurity against any person, including a democratic institution, or government on behalf of the Government of the Russian Federation.
Today, OFAC is taking further action against key TsNIIKhM employees who were present at the time of the attack. On March24, 2022, the Department of Justice unsealed the indictment of Evgeny Viktorovich Gladkikh (Gladkikh), who is an employee in TsNIIKhM’s Applied Development Center (ADC). Gladkikh is involved in ICS and supervisory control and data acquisition (SCADA) research and has extensive experience working network exploitation and penetration testing.
Since at least 2017, ADC employees, including Gladkikh, prepared, supported, conducted, and conspired to conduct computer intrusions using ADC resources that targeted the energy facilities in the United States and elsewhere. Gladkikh, along with other TsNIIKhM and ADC employees, played a crucial role in the August 2017 Triton malware cyber-attack, specifically targeting the petrochemical facility’s safety instrumented systems, seeking to disrupt the facility’s cybersecurity systems, as well as the facility’s distributed controls systems. Gladkikh’s malicious cyber actions resulted in the facility undergoing an emergency shutdown on at least two occasions.
Sergei Alekseevich Bobkov (Bobkov) is TsNIIKhM’s General Director, since at least October 2017. Konstantin Vasilyevich Malevanyy (Malevanyy) is TsNIIKhM’s Deputy General Director and has been a Chief of the ADC since at least January 2017. Bobkov and Malevanyy work directly with military representatives of the Russian Ministry of Defense and other Russian institutions with ties to Russia’s defense sector. Additionally, Malevenyy, has connections with the Russian FSB through his roles at TsNIIKhM and the ADC.
Gladkikh, Bobkov, and Malevanyy are being designated pursuant to Section 224(a)(1)(B) of CAATSA for acting or purporting to act for or on behalf of, directly or indirectly, TsNIIKhM.
SANCTIONS IMPLICATIONS
As a result of today’s action, all property and interests in property of the designated persons described above that are in the United States or in the possession or control of U.S. persons are blocked and must be reported to OFAC. In addition, any entities that are owned, directly or indirectly, individually or in the aggregate, 50 percent or more by one or more blocked persons are also blocked. Unless authorized by a general or specific license issued by OFAC, or exempt, OFAC’s regulations generally prohibit all transactions by U.S. persons or within (or transiting) the United States that involve any property or interests in property of designated or otherwise blocked persons. In addition, financial institutions and other persons that engage in certain transactions or activities with the sanctioned entities and individuals may expose themselves to sanctions or be subject to an enforcement action. The prohibitions include the making of any contribution or provision of funds, goods, or services by, to, or for the benefit of any blocked person, or the receipt of any contribution or provision of funds, goods, or services from any such person.
