OFAC Expands Iran Sanctions to Digital Assets and Designates MOIS-Linked Cyber Actors
Summary
OFAC’s new Iran sanctions include a first-ever sectoral determination for digital assets and designations of MOIS-linked cyber actors. The action also targets crypto payments tied to Iranian oil sales and increases sanctions exposure for global crypto businesses.
Key points
- Treasury launched Operation Economic Outcast on August 24, 2026, targeting Iran and its enablers; OFAC sanctioned nearly 60 entities, individuals, and vessels.
- OFAC applied a sectoral determination to Iran’s digital-assets sector for the first time, exposing foreign businesses that support it to possible sanctions and loss of U.S. financial-system access.
- OFAC designated MOIS-linked cyber actors, including Behzad Mesri, Keyvan Fayyaz Ghareh Blagh, and Arman Kahzadian, and flagged cryptocurrency addresses associated with them.
- The article reports that members of the group were linked to data theft, attacks on organizations and government offices, cryptocurrency theft, and ransomware activity.
- OFAC designated Ivan Obukhov, whom Treasury says processed more than $100 million in crypto payments since 2023 to facilitate oil sales for the IRGC-Qods Force.
- The designations were coordinated with an August 18 DOJ superseding indictment charging Iranian cyber actors.
- The article advises crypto compliance teams to review Iran-linked counterparties, particularly OTC brokers, exchanges, and payment intermediaries.
Article Details
- Event Type
- OFAC sanctions designations and a first-of-its-kind sectoral determination covering Iran’s digital assets sector, announced as part of Operation Economic Outcast.
- Impact
- The determination expands secondary-sanctions exposure to foreign persons who operate in or support Iran’s digital assets sector. OFAC also designated MOIS-linked cyber actors and individuals involved in cryptocurrency-enabled oil payments. The article reports that designated cyber actors were linked to hacking, data theft, ransomware, and cryptocurrency theft; it provides no specific wallet addresses.
People
Arman KahzadianIdentified as a member of the MOIS-linked cyber group and designated by OFAC. According to OFAC, he stole cryptocurrency.Behzad MesriIdentified as a co-leader of the MOIS-linked cyber group; OFAC designated him. A DOJ indictment accused him of attempting to extort HBO for approximately $6 million in Bitcoin after a 2017 hack.Ivan ObukhovUAE-based Ukrainian national designated by OFAC. According to the Treasury, he brokered Iranian shadow-fleet oil shipments and processed more than $100 million in cryptocurrency payments since 2023 to facilitate oil sales on behalf of the IRGC-QF.Keyvan Fayyaz Ghareh BlaghIdentified as a member of the MOIS-linked cyber group and designated by OFAC. Chainalysis says he conducted ransomware attacks and received a ransom payment; the article also describes his cryptocurrency transactions with bulletproof hosting providers.Mohammad Ahmed Suhil FattouhUAE-based Syrian national and shadow-fleet broker designated by OFAC; identified as a collaborator of Ivan Obukhov in purchasing vessels later used for sanctions evasion. The article gives his alias as “Captain Hamzah.”Scott BessentTreasury Secretary who described Operation Economic Outcast as an “economic D-Day.”
Threat Actors
Arman KahzadianOFAC-designated member of an MOIS-linked cyber group. OFAC says he stole cryptocurrency.Behzad MesriOFAC-designated co-leader of an MOIS-linked cyber group; a DOJ indictment accused him of attempting to extort HBO after a 2017 hack.Keyvan Fayyaz Ghareh BlaghOFAC-designated member of an MOIS-linked cyber group. Chainalysis reports that he conducted ransomware attacks.Mabna InstituteIran-based hacking-for-hire organization named in connection with cybercrimes charged in a DOJ superseding indictment.