UK Sanctions Target the Evolving Cryptomus Cryptocurrency Network, Impacting Russian Cybercrime Financing

Attack Summary
On October 8, 2026, the United Kingdom imposed sanctions against the cryptocurrency platform Cryptomus and its rebranded version, Heleket, recognizing them as significant facilitators in the financing of cybercrime and other illicit activities tied to the Russian government. The sanctions are aimed at freezing Cryptomus’s assets within the UK and prohibiting British companies from engaging in business with these entities. Since its inception in 2022, Cryptomus has reportedly processed over $7 billion in transactions, including funds linked to ransomware, drug trafficking, and various cybercrime services. While the previous sanctions imposed by Canada in 2025 were ineffective in curbing operations, the UK sanctions may impede the functionality of this cryptocurrency payment processor and disrupt its network facilitating illicit activities.

Tactics, Techniques, and Procedures (TTPs)
The sanctions against Cryptomus highlight a sophisticated infrastructure used for money laundering and cybercrime facilitation through the exploitation of cryptocurrency platforms. Initial access to criminal networks appears mostly facilitated through phishing campaigns (T1566), while ongoing operations leverage a combination of valid accounts (T1078) and registration of shell companies to maintain anonymity and operational cover. The Cryptomus network utilizes multiple names and rebranding practices, including its most recent iteration, Heleket, to evade regulatory scrutiny.

Persistence mechanisms observed include operating in regions with lax regulatory regimes, often under the guise of oversight from non-recognized authorities (T1584.001). The command-and-control infrastructure is characterized by domain generation algorithms and the use of multiple identities across various exchanges. The exfiltration of funds is executed via obfuscated transactions, most notably being concentrated within decentralized finance (DeFi) to bypass traditional financial channels, aligning with techniques such as T1071.001 (Application Layer Protocol: Web Traffic).

Threat Actor Context
The Cryptomus organization is believed to be linked to various cybercriminal associations within Russia, likely indicating its operational connections to state-sponsored activities. By functioning primarily as a payment processor for illicit services, Cryptomus—previously operating under Certa Payments and Xeltox Enterprises—has established itself as a crucial actor in bolstering the financing of criminal endeavors tied to Russian interests. The geopolitical motivations appear to align with the need for financial systems that can bypass sanctions imposed by Western nations, especially post-invasion sanctions. The operational methodologies, underscored by the use of complex financial structures, underscore a high level of sophistication likely indicative of state-level protection or support.

Indicators of Compromise (IOCs)
While specific technical indicators such as IP addresses or malware hashes were not disclosed in the recent sanctions, defenders should remain vigilant for signs of traffic connecting to the following domains linked with Cryptomus and its aliases:

• Certa Payments
• Heleket
• Xeltox Enterprises
• VexPay
• TokenSpot
• Tsunami Payments
  Additionally, observations for transactions linked to child sexual abuse material vendors, terrorist financing networks, and other illicit activities should be prioritized, especially those involving high volumes of cryptocurrency.

Detection and Hunting Guidance
Security operations centers (SOCs) should monitor and analyze network logs for unusual spikes in traffic directed towards the aforementioned domains. Utilizing SIEM platforms, queries should focus on identifying anomalous blockchain transaction patterns, particularly those lacking in KYC compliance, that exceed baseline volume from traditionally benign sources. Network and EDR sensors should alert to unexpected use of decentralized exchanges or mixers—known methods for obfuscating transaction originations.

Recommended logs to be monitored include:

• Firewall logs for outbound connections to suspicious domains.
• Web Proxy logs to capture unusual access patterns to cryptocurrency exchanges.
• User Account Activity logs to check for multiple simultaneous logins from known phishing targets or compromised accounts.

High-risk indicators such as communications with Telegram bots claiming association with Cryptomus should also be tracked, noting any abnormal behavioral changes among user accounts.

Mitigation Recommendations
Organizations should strengthen their defenses against potential exploitation by implementing the following controls:

1. Enhance KYC Procedures: Ensure robust KYC practices are enforced, reducing the risk associated with dealing in cryptocurrencies that lack sufficient identification protocols.
2. Network Segmentation: Isolate systems that interact with cryptocurrencies from core IT infrastructure to limit potential damage from a breach.
3. Threat Intelligence Integration: Employ threat intelligence feeds focusing on cryptocurrency activity and criminal networks to assist in proactive monitoring and response.
4. User Training: Regularly train users on recognizing phishing attempts targeted at escalating cryptocurrency transactions or disclosure of sensitive financial information.
5. Incident Response Preparedness: Develop and test incident response plans specifically targeting cryptocurrency fraud and financial crime scenarios.

Full Circle Cyber Analyst Takeaway
The sanctions against Cryptomus signal a critical shift in the international effort to mitigate the implications of cryptocurrency in facilitating state-aligned cybercrime. As geopolitical tensions rise and new digital financial systems emerge, organizations need to be increasingly vigilant against the exploitation of these platforms by sophisticated threat actors. The resilience and adaptability of criminal enterprises in the cryptocurrency space underscore the urgency for enhanced security measures and collaborative efforts across nations to deter such illicit funding mechanisms.