Who is Task Force Rusich – the ‘neo-Nazi paramilitary group’ sanctioned by OFAC yesterday?

It’s been a busy week for U.S. Treasury’s Office of Foreign Assets Control (OFAC), who on Tuesday, September 14, issued a round of cyber- and Iran-related updates that included cryptocurrency addresses linked to individuals affiliated with Iran’s Islamic Revolutionary Guard Corps (IRGC). And just yesterday, additional designations were announced, this time targeting individuals and entities for their “involvement in Russia's invasion of Ukraine” and Russia's attempt to find new ways to "process payments and conduct transactions." 

One of the entities designated in yesterday’s announcement is Task Force Rusich, which is described by OFAC as a ‘neo-Nazi paramilitary group that has participated in combat alongside Russia’s military in Ukraine.” OFAC also added individuals affiliated with the group – “two of its senior leaders" – and five cryptocurrency addresses linked to the group to its SDN list:

• bc1ql7dlyh8xz6tpqk92vztrhqh88dmjvcwrmsemrm
• bc1q2lpgjntr348pfvxhfy33ehmdzy3gmx8w4052z6
• 0xc2a3829F459B3Edd87791c74cD45402BA0a20Be3
• 0x3AD9dB589d201A710Ed237c829c7860Ba86510Fc
• TX5GV4DyfxNB3rPkzZJhmqZ1efVmL4rEqG

TRM analysts have been studying Task Force Rusich and their use of cryptocurrencies since earlier this year as part of a broader review of extremist groups and the risks they pose to organizations facilitating the movement of digital assets, like exchanges; the leaders of Task Force Rusich were also sanctioned by the EU in February 2015. Here is a summary of what we know:

The group is Russian-founded and has a reputation for brutality

‍Task Force Rusich was founded in the summer of 2014 by Russians Alexey Yurevich Milchakov and Yan Igorevich Petrovskiy, and has been linked to Russian combat operations in the Middle East, Africa, and Ukraine.

Prior to the February 2022 Russian invasion of Ukraine, Task Force Rusich developed a reputation for its brutality and links to neo-Nazi ideology and symbolism. Rumors of Milchakov biting a puppy’s head off and disseminating photos of dead Ukrainian soldiers during the group’s 2014 combat efforts in Ukraine underscores this brutality. Further, the group has been investigated for war crimes by the Hague, in addition to being sanctioned as a group or at the leadership level by the United States, European Union, Australia, Canada, and Switzerland.

TRM analysis shows Task Force Rusich has raised more than $100,000 in crypto since March 2022

‍A Task Force Rusich Telegram account began disseminating cryptocurrency addresses to fundraise for specific combat-related items at the start of the February 2022 Russian invasion of Ukraine. Specific items mentioned in the solicitation include weapons sights, vehicles, drones and body armor.

Since March 2022, Task Force Rusich has received about $138,000 to 11 addresses – including the five sanctioned by OFAC on September 15 and six additional addresses linked to the group by TRM. The most recent transactions into these addresses amount to approximately $400 and occurred as recently as September 13, 2022 – two days before the sanctions. Approximately $9,000 in cryptocurrency remains in the addresses’ balance as of the morning of September 16, 2022.

Notably, since the 11 addresses first started receiving funds in March, almost $60,000 of the funds received were sent from addresses ‘resolved,’ or hosted, at major global exchanges and virtual asset service providers (VASPs). For the same period, Task Force Rusich sent almost $64,000 from the 11 addresses to addresses resolved at three exchanges, likely as part of a process to convert them to cash or traditional currencies for use.

‍

‍

Task Force Rusich posted about the sanctions on September 15:

Given the group’s awareness of the sanctions, unspent cryptocurrency balance, and fundraising efforts, TRM Labs will continue to track Task Force Rusich to mitigate threats originating from the group. 

How organizations are using TRM to mitigate exposure to Rusich and other sanctioned addresses

The world’s leading cryptocurrency businesses, decentralized finance (DeFi) projects, and financial institutions leverage TRM solutions to automatically detect blockchain transactions with exposure to sanctioned addresses – and addresses meaningfully linked to sanctioned addresses – in line with guidance from OFAC and other global regulators. In the case of Task Force Rusich, TRM identified six addresses in addition to those listed by OFAC that are conclusively affiliated with the entity.

Using advanced blockchain intelligence heuristics and analysis, TRM provides enhanced visibility into the broad spectrum of sanctions exposure an organization may face — including direct, counterparty and indirect (downstream or upstream) exposures.

For more information on our solutions and resources for sanctions compliance: contact@trmlabs.com.