The attacks are believed to have affected nearly 2000 victims in 71 countries. The cyber actors are known for specifically targeting large corporations, effectively bringing their business to a standstill.

Ransom notes demanded victims pay the attackers in Bitcoin in exchange for decryption keys. 

A number of the individuals are suspected of being in charge of laundering the ransom payments. They would funnel the Bitcoin ransom payments through mixing services, before cashing out the ill-gotten gains. 

The operation took place on 26 October in Ukraine and Switzerland. Most of the suspects are considered high-value targets because they are being investigated in multiple high-profile cases in different jurisdictions.

Authorities from Norway, the United Kingdom, France, the Netherlands, Ukraine, Germany, Switzerland and the United States were involved in the operation.

Bruno Le Maire, France''s Minister of Finance, Sébastien Lecornu, Minister for the Overseas, and Olivier Dussopt, Secretary of State to the Ministry of Public Action and Account, announced an ordinance to strengthen anti-money laundering/combating terrorism financing (AML/CTF).

This sees crypto-to-crypto exchanges and digital asset service providers being brought into the fold of AML/CTF rules under the Monetary and Financial Code, with the same obligations applying to those actors, in particular in terms of AML/CTF risks, KYC and the verification of beneficial owners, as well as in respect of co-operation with intelligence and asset freezing services.

Some of the proposals include:

• digital asset service providers will be banned from keeping anonymous accounts;
• digital asset service providers and trading platforms will need to register with the Autorité des marchés financiers within six months of the passing of the ordinance;
• digital asset service providers based outside the country would need to register with the Autorité des marchés financiers in order to trade; and
• the measures apply to French overseas territories.

“This ordinance strengthens the fight against the anonymity of transactions in digital assets by including digital asset service providers… among the entities being banned from keeping anonymous accounts," the press release said.

“New regulatory provisions will be presented to speed up the launch on the market of digital identity solutions for digital asset transactions. This request, which comes from actors in the ecosystem, will make it possible to fight against anonymity in digital assets transactions while facilitating user identification.”

From 19 December 2020, unregistered service providers offering services of custody of digital assets for third parties or the purchase and sale of digital assets in legal tender in France will be liable to a two-year prison sentence and a fine of €30,000 under the Monetary and Financial Code.

The AMF and the ACPR said that service providers that are not registered by that date will have to stop their activity in France pending their registration.

An exception will apply, however, for those service providers providing digital asset custody services, of the execution of instructions to transfer digital assets to an external portfolio, subject to compliance with anti-money laundering and combating the financing of terrorism (AML/CFT) and asset freezing regulations.

"The authorities shall oversee compliance with the regulations and take appropriate action in the event of any infringement. In particular, the AMF could publish a black list of unregistered service providers, together with a warning to the general public and, if necessary, take legal action to block access to the websites of any unregistered service providers," the two authorities said.

However, for service providers that have submitted their application for registration in good time and whose registration procedure is at a very advanced stage, the authorities said that they may take account of their situation on a case-by-case basis. These service providers will still have to stop all promotional activities and not accept any new clients until they are registered.

Under the Pacte Law, digital asset service providers that offer digital asset custody services for third parties or offer purchase and sale of digital assets in legal tender must be registered with the AMF, after receiving a positive opinion from the ACPR.

Registration entails the implementation of an organisation, procedures and internal control system to ensure compliance with the obligations under the anti-money laundering and combating the financing of terrorism and the freezing of assets.