US, Estonia to send confiscated Russian funds to Ukraine. Are ransomware proceeds next?

MUNICH, GERMANY — Estonia and the U.S. signed an agreement on Saturday that will transfer $500,000 in confiscated Russian funds to Ukraine. The monies will first be transferred to Estonia who will then send them to Ukraine to help it reconstitute its electrical grid after months of bombing by the Russians.

This marks the first time the U.S. will use a foreign ally as a kind of cut out to funnel aid to Ukraine.

The announcement is part of a broader effort to target oligarchs and people who are helping prop up Russia’s war machine and hold them to account. The Justice Department set up a special task force, called KleptoCapture, back in 2022 in a bid to get various federal agencies to focus on enforcing the sweeping economic measures the U.S. imposed on Russia after the invasion of Ukraine.

Saturday’s announcement raises the specter that other illicit gains, like ransomware payments, could be included in this kind of action in the future — though Congress would need to broaden the current authorities first. The $500,000 transfer in Saturday’s agreement is linked to a Connecticut company that was helping send a dual-use technology called a jig grinder to Russia, which violates the sanctions regime.

In an interview with Recorded Future News following the signing, Deputy Attorney General Lisa Monaco and Assistant Attorney General for National Security Matthew Olsen said that they are continuing to look for new and creative ways to hold Russia to account.

"We will continue to hold Russia accountable for its brutal invasion of Ukraine using every lawful tool at our disposal — including our cyber authorities. Russia should take note and stay tuned,” Monaco said.

The agreement with Estonia to act as a kind of conduit in this case, Monaco said, was required because the transfer of this jig machine was “an export control violation, which is not covered under the authority that we got last year.”

The current authorities include components that help in the production of advanced Russian precision-guided weapons systems, and select electronic components that might help the Russian war effort.

Transferring Funds

The ability to transfer illicit assets to Ukraine comes from a congressional authority that the Department of Justice secured last year. Essentially, it says that if prosecutors can show that the forfeited funds are tied to the commission of a specific crime — such as the violation of sanctions that were imposed after the 2022 invasion — then the DOJ can get a court order that permits them to transfer the funds.

Some analysts say there is the potential for forfeited ransomware payments to be used in a similar way — proceeds from ransomware attacks could be included in the basket of offenses that allow them to garnish the funds and send them to Ukraine. Naturally, victims, if they can be identified, would be made whole first, they say. The crypto currency tracing firm, Chainalysis, said ransomware payments are thought to have topped $1 billion last year.

In the case of the latest funds transfer with Estonia, Monaco said the Justice Department identified a network trying to smuggle a jig grinder into Russia. Jig grinders are used in the defense industry to make precision cuts and they are under strict export controls.

The U.S. does not allow them to be exported to Russia and managed to intercept the machine in Latvia before it made its way to Russia. A citizen of Latvia was charged in connection with the scheme earlier this week and pleaded guilty to U.S. export laws and regulations.

“Today’s announcement demonstrates the unwavering resolve of the United States and our Estonian partners to cut off President Putin's access to the Western technologies he relies on to wage an illegal war against Ukraine,” Monaco said during the press conference.

Secretary General Tõnis Saar of the Estonian Ministry of Justice told reporters at the signing that “the goal here is not only to detect, prosecute and ensure justice, but to direct illegal income to the victim, i.e. Ukraine,” he said. “I hope that this will become the new normality for sanctioned crimes in other countries in the future.”

Estonia said the funds have already been earmarked to finance a drone program that will help assess the damage Russian attacks have done to Ukraine’s electrical distribution and transmission infrastructure.

READ MORE: Munich Cyber Security Conference 2024 Live Updates