Overview
The Sanctions Update, compiled by attorneys from Steptoe’s award-winning International Regulatory Compliance team and the Stepwise: Risk Outlook editorial team, publishes every Monday. Guided by the knowledge of Steptoe’s industry-leading International Trade and Regulatory Compliance team, the Sanctions Update compiles and contextualizes weekly developments in international regulatory enforcement and compliance, as well as offers insights on geopolitical context, business impacts, and forthcoming risks.
Subscribe to the Stepwise Risk Outlook here. To receive only the Sanctions Update edition (published most Mondays), select “Stepwise Risk Outlook: Sanctions Update.” For more detailed analysis on related issues, see Steptoe’s International Compliance Blog. For information on industry-specific monitoring or bespoke services, please contact the team here.
The Lede
US Cracks Down on Russian Entity for Facilitating Cybercrime Operations
Last week, the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) imposed sanctions on Aeza Group, its two affiliated companies, four of its executive leaders, and its front company based in the UK. Aeza Group, a Russia-based provider of bulletproof hosting (BPH) services, offers servers and virtual infrastructure tailored to help cybercriminals conduct illicit activities while evading detection. The sanctions against Aeza Group and its affiliates were issued for providing services to ransomware and malware groups that have targeted the US, undermining the nation’s economic and national security.
The 2025 Global Threat Landscape Report by Fortinet highlights the growing scale and sophistication of ransomware attacks, with BPH services enabling less-skilled actors to execute high-impact campaigns. The ransomware-as-a-service market—a business model in which threat actors develop and offer ransomware tools or platforms to other cybercriminals—has also expanded, with 2024 seeing the emergence of six new major groups. This growth underscores how the cybercriminal landscape is evolving, making ransomware operations more accessible.
While Russian authorities have increased efforts to crack down on domestic cybercrime, including tighter financial controls and extended prison sentences, these initiatives primarily target attacks within Russia’s borders and fail to address growing international concerns about Russian-linked cybercriminals targeting foreign entities. Notably, Russian law enforcement arrested two leaders of Aeza Group for hosting the illicit drug marketplace Blacksprut on their infrastructure. However, such efforts are widely perceived as Russia focusing solely on addressing domestic priorities, like narcotics trafficking, rather than cooperating with international enforcement bodies to tackle global cybercrime threats. Russia’s commitment to meaningful cooperation in combating global cybercrime was further doubted by its proposed, legally binding UN convention against cybercrime—set to open for signature by member states this October. Critics argue the convention advances authoritarian surveillance agendas by failing to include robust safeguards, further underscoring the Kremlin’s tendency to prioritize domestic control and influence over international cooperation in combating cyber threats.
Moreover, Russia has increasingly mobilized cyber actors to execute attacks that serve the state’s foreign interests. These actors include the military, security agencies, recruited cybercriminals, state-coerced technology developers, and patriotic hackers. According to the Atlantic Council, Russia’s cyber ecosystem is dynamic—shaped by interagency rivalries, competition for government contracts, and even encouragement from the government for independent cybercriminals to target foreign entities. This environment provides the Kremlin access to a wide range of talent and capabilities to leverage in support of its objectives.
As the cybercriminal ecosystem strengthens, the US government has focused on addressing these emerging threats through sanctions and updated cyber policies. In 2024, the number of people the US sanctioned for cybercriminal activities almost doubled from the year prior. Russia’s increasingly aggressive posture has placed it at the center of US-led efforts to combat cybercrime and protect national security, with Russia accounting for the largest number of persons sanctioned for cybercriminal activities in 2024. Between 2022 and 2024, over 170 new sanctions were imposed each month on Russian-linked entities.
Meanwhile, the Trump administration has been more hesitant to impose sanctions on Russia. For example, there have been no new designations to the SDN list under the main Russia sanctions authorities, despite significant movement from the G7and Congress, as exemplified by Sen. Lindsey Graham’s Sanctioning Russia Act of 2025, which would impose sanctions on Russia and steep tariffs on importers of its fuels if it does not seriously entertain a ceasefire. The administration maintains that new economic attacks would compromise any flexibility to negotiate a settlement to the Russia-Ukraine war. However, in February, the administration took a step further under its cyber-related sanctions program by imposing sanctions on Zservers—a Russian BPH services provider—and two Russian nationals operating the company, although these sanctions did not fall under Russian-specific sanctions authorities.
Last week’s sanctions on Aeza Group and its affiliates marked the first use of the Countering America’s Adversaries Through Sanctions Act—Russia (CAATSA-RUSSIA) by the current Trump administration. These sanctions also utilized the newly created cybersecurity-specific sanctions tag, CYBER4. OFAC explained that Aeza Group has provided vital infrastructure to major Russian ransomware, malware, and infostealer groups targeting US defenses and technology firms, in addition to hosting a Russian darknet marketplace for illicit drugs that contributes to global trafficking.
The CYBER4 sanctions tag stems from President Trump’s June 6thexecutive order, which revises prior cybersecurity initiatives introduced by the Obama and Biden administrations. The order shifts federal cybersecurity strategies to narrower, simpler, and more decentralized approaches, with a notable emphasis on prioritizing AI to automate cyber defense efforts and rapidly detect vulnerabilities. Importantly, the order limits the application of cybersecurity-related sanctions to targeting foreign malicious actors, aligning with the administration's focus on major US adversaries such as Russia, China, Iran, and North Korea.
Coupled with the administration’s earlier sanctions on Zservers, last week’s designation of Aeza Group reflects a growing recognition of the evolving cyber threat landscape, where services like BPH enable global accessibility to disruptive cybercrime operations. Such sanctions on BPHs underscore the administration’s shift toward a more targeted cybersecurity enforcement strategy that disrupts entire supply chains, enabling many cybercrimes to even take place. For industries operating in critical sectors, this development highlights both the increasingly sophisticated ecosystem of Russian cyberthreat actors and the growing resilience in specialized cyber hosting services. As the US refines its cyber priorities and leverages AI-driven defenses, the coming months could see heightened scrutiny of service providers, particularly those emerging from Russia and other US adversarial nations, and the rollout of additional sanctions targeting cybercrimes that impact US national security.
US Developments
US Implements Broad Sanctions Relief for Syria
On June 30, President Trump issued Executive Order (EO) 14312 revoking six previously issued EOs imposing comprehensive sanctions on Syria, while simultaneously continuing sanctions against former Syrian President Bashar al-Assad, as well as his associates and other destabilizing regional actors. The Department of the Treasury’s Office of Foreign Assets Control (OFAC) had previously issued a general license authorizing a wide range of activity that was otherwise prohibited under the Syria sanctions program. Among other measures, EO 14312:
- unblocked the property of persons previously designated solely pursuant to one or more of the six EOs revoked by the President;
- authorized the continuation of sanctions against former Syrian President Bashar al-Assad, his associates, and other destabilizing regional actors, via the creation of the Promoting Accountability for Assad and Regional Stabilization Sanctions (PAARSS);
- directed the Secretary of State to determine whether to suspend in whole or in part the imposition of sanctions required by the Caesar Syria Civilian Protection Act;
- waived the application of certain provisions of the Syria Accountability and Lebanese Sovereignty Restoration Act (“Syria Accountability Act”) that imposed certain licensing requirements under US export controls;
- ordered the Secretary of State to “take all appropriate action” to review the designation of Syria as a State Sponsor of Terrorism (SST);
- waived certain sanctions imposed on Syria for the prior use of chemical weapons;
- directed the Secretary of State to “take all appropriate action” with respect to the designation of the Hay’at Tahrir al-Sham (HTS) as a Foreign Terrorist Organization (FTO) and Specially Designated Global Terrorist (SDGT); and
- ordered the Secretary of State to explore avenues at the United Nations (UN) to provide sanctions relief for Syria in support of US objectives.
The measures were generally welcomed by members of Congress, including Senators Jim Risch (R-ID) and Jeanne Shaheen (D-NH), the Chairman and Ranking Member of the Senate Foreign Relations Committee, respectively, who commended the Trump administration on its decision.
While many of the sanctions and export controls-related measures concerning Syria have been or will be repealed or modified, it is important for industry to be mindful that certain restrictions on Syria remain in place.
Sanctions on Iran Continue as Iran Suspends Participation with IAEA
On July 3, OFAC and the State Department announced multiple actions against individuals and entities alleged to be supporting Iran and its proxy Hizballah:
- In one action, OFAC designated multiple individuals and entities for their alleged participation in networks that transport and purchase Iranian oil. OFAC stated in its press release that some of the alleged activities directly supported the Islamic Revolutionary Guard Corps-Qods Force (IRGC-QF), a Foreign Terrorist Organization (FTO) and Specially Designated Global Terrorist (SDGT). Concurrently, and in a related action, the State Department announced that it was sanctioning six entities for having knowingly engaged in a significant transaction concerning petroleum or petrochemical products from Iran.
- In a separate action, OFAC sanctioned seven alleged senior officials and one entity allegedly associated with the Hizballah-controlled Al-Qard Al-Hassan (AQAH), which was previously designated by OFAC in 2007. According to OFAC, the individuals and entity have facilitated sanctions evasion for Hizballah on multiple occasions, including through transactions which reflect a pattern of previously sanctioned “shadow banking.”
The US continues to impose sanctions against Iran and its proxies in accordance with the terms of the “maximum pressure” strategy stated in National Security Presidential Memorandum 2 (NSPM-2). This most recent round of sanctions follows Iran’s announcement that it will no longer be cooperating with the International Atomic Energy Association (IAEA), which the State Department has called “unacceptable.”
Logistics Company Enters Settlement Agreement Over Alleged Cuba Sanctions Violations
Key Holding, LLC, a Delaware-based logistics company, has entered into a settlement agreement with OFAC for its apparent violations of the Cuba Assets Control Regime (CACR). According to the enforcement release, Key Holding will pay $608,825 for non-egregious and voluntarily disclosed apparent violations, which allegedly occurred when a subsidiary of Key Holding managed the logistics for 36 freight shipments from Colombia to Cuba. The CACR applies to non-US subsidiaries of US persons.
The settlement was announced a few days after President Trump issued National Security Presidential Memorandum 5 (NSPM-5), which reasserted the administration’s hardline position on Cuba and called for stricter enforcement of Cuban sanctions and travel restrictions. The Trump administration appears poised to resume its “tough-on-Cuba” posture from the administration’s first term. Earlier this year, President Trump revoked two of former President Biden’s orders, which, among other things, sought to rescind Cuba’s designation as a State Sponsor of Terrorism (SST) and revoked President Trump’s first-term NSPM-5 on Cuba.
UK Developments
UK Updates Arms Embargo Interpretation for Armenia and Azerbaijan
The UK has issued a notice revising its interpretation of the Organisation for Security and Co-operation in Europe (OSCE) arms embargo on Armenia and Azerbaijan. The OSCE has imposed a voluntary arms embargo on Armenia and Azerbaijan since 1992. Under the updated approach, the embargo now only applies to weapons, ammunition, and munitions listed under entries ML1–ML4 of the UK Military List, rather than all military-listed items. Additionally, restrictions now cover exports to police, military, or security forces operating on the Armenia–Azerbaijan land border, amending the previous coverage of items potentially used in the Nagorno-Karabakh region. Export and trade licence applications will continue to be assessed against the Strategic Export Licensing Criteria (SELC), with UK guidance updated to reflect these changes.
UK Charges Software Developer with Sanctions Breaches by Funding Eastern Ukraine Militias
A UK court has charged a Russian-British dual national, Mikhail Vlasov, with eight counts of breaching UK sanctions by financing pro-Russian separatist militias in eastern Ukraine. Prosecutors allege that Mr. Vlasov sent approximately £4,000 in cryptocurrency between April 2022 and April 2023 to organisations linked to the Donetsk and Luhansk People’s Republics for purchasing drones, weapons, ammunition, and uniforms. Mr. Vlasov pled not guilty to all charges during his appearance at Westminster Magistrates’ Court. Mr. Vlasov was granted bail and is due to appear in court later this month. Prosecutors described his actions as deliberately circumventing sanctions while supporting Russian military operations. This is the second UK prosecution for breaches of Russia-related sanctions since the 2022 invasion.
UK Authorities Issue Red Alert on Russian Oil Sanctions Evasion Network Using Shadow Fleet
A group of UK authorities, including the National Crime Agency, have jointly issued a Red Alert highlighting the sophisticated network facilitating Russian oil sanctions evasion. The alert outlines how Russian oil exports continue to fund its war in Ukraine. In one pertinent part, the alert suggests that Russian oil trading companies are leveraging complex networks to bypass sanctions and access Western finance and services to sustain these revenue streams. In particular, the alert identifies several entities that have played a central role in facilitating substantial volumes of Russian oil trades, including the majority of Rosneft’s exports. These entities include two individuals (UK-sanctioned Azeri nationals, Etibar Eyyub and Tahir Garayev), and three companies (2Rivers DMCC, 2Rivers Pte, and Nord Axis, which were sanctioned by the UK between December 2024 and May 2025). The alert reflects the continued focus of UK sanctions agencies on Russia’s energy sector and the theme of sanctions evasion.
EU Developments
Hungary and Slovakia Block Agreement on 18th Sanctions Package
Following the European Commission’s unveiling of the 18th sanctions package last month, reports have confirmed that EU ambassadors were unable to reach an agreement during discussions held on June 27. With the clock ticking, there was mounting pressure to finalize a deal before the end of Poland's Council Presidency on June 30. However, the agreement failed to materialize due to strong opposition from Hungary and Slovakia, who claim the sanctions and related measures, such as the REPowerEU plan to end Russian gas imports by 2027, would disproportionately harm their economies. Slovak Prime Minister Robert Fico argued that the initiative could lead to billions in losses and higher energy costs for consumers, a stance echoed by Hungary. With Poland’s term now concluded, the incoming Danish Presidency of the EU Council will face the challenge of securing an agreement on the 18th sanctions package.
In a July 4 press briefing, the Commission announced plans to set up an expert group to monitor the REPowerEU plan’s impact on landlocked countries, signaling continued efforts to address Slovak and Hungarian concerns.
EU Council Extends Economic Sanctions Until 2026 In Response to Russia’s Destabilizing Actions
The EU Council has extended the economic sanctions established under Decision 2014/512 for an additional six months, now effective until January 31, 2026. Initially adopted in 2014, the sanctions regime has been reinforced since February 2022 in response to Russia’s ongoing illegal military aggression against Ukraine. The restrictive measures target a wide range of sectors, including trade, finance, energy, technology and dual-use goods, industry, transport, and luxury items. In addition, the sanctions include a ban on the import of certain petroleum products from Russia, the disconnection of several Russian banks from the SWIFT financial messaging system, and a prohibition on broadcasting any content by entities listed in Annex IX to Decision 2014/512.
Germany and Sweden Tighten Controls on Tankers Linked to Russian Target Shadow Fleet
As of July 1, Germany authorities began enforcing stricter measures targeting the Russian shadow fleet, requiring tankers traveling eastward through the Fehmarn Belt to provide proof of valid insurance against oil pollution damage. According to German Federal Foreign Minister Johann Wadephul, the initiative aims to exert pressure on the Russian shadow fleet used to circumvent sanctions while also protecting the Baltic Sea habitat.
Sweden has also stepped up its controls, launching insurance checks across its territorial waters and ports on the same day. Authorities in both Member States have raised concerns about the environmental and safety risks posed by uninsured tankers or those with inadequate coverage. German Federal Transport Minister Patrick Schnieder added that anomalies in the documentation of vessels operating in the Baltic Sea could prompt Europe-wide responses, including measures imposed by flag states, and potentially result in such vessels being added to the list of sanctioned ships if additional criteria are met.
Asia-Pacific Developments
China Sanctions Former Philippine Senator Over South China Sea Stance
China has imposed sanctions on former Philippine Senator Francis Tolentino, citing his “egregious conduct” related to the South China Sea disputes. On July 1, 2025, the Ministry of Foreign Affairs of the People’s Republic of China announced that Tolentino, a close ally of President Ferdinand Marcos Jr., is now barred from entering mainland China, Hong Kong, and Macau. The move follows Tolentino’s active role in maritime legislation during his Senate term, including his authorship of the Philippine Maritime Zones Act and the Philippine Archipelagic Sea Lanes Act, both signed into law in November 2024. These laws delineate the Philippines’ maritime boundaries and establish navigational routes, aligning with the 2016 arbitral ruling that invalidated China’s claims in the South China Sea—an outcome Beijing continues to reject.
In addition to his legislative work, Tolentino led a Senate investigation into alleged Chinese espionage and disinformation operations in the Philippines. He publicly accused the Chinese embassy of orchestrating online campaigns to influence public opinion and undermine Philippine sovereignty. The sanctions were announced shortly after Tolentino concluded his Senate term, with Chinese officials labeling him among a “handful of anti-China politicians” whose actions have strained bilateral relations. In response, Tolentino described the sanctions as a “badge of honor,” reaffirming his commitment to defending the Philippines’ maritime rights.
Australia Imposes New Sanctions on Russia Amid NATO Summit
Australia has imposed a new wave of targeted sanctions against Russia, reinforcing its commitment to holding Moscow accountable for its ongoing invasion of Ukraine. The latest measures include financial sanctions and travel bans on 37 individuals, as well as financial sanctions on seven entities linked to Russia’s defence, energy, transport, insurance, electronics, and finance sectors. According to Foreign Minister Penny Wong, the sanctions are closely coordinated with key NATO partners, including the UK, Canada, and the EU, and bring Australia’s total number of sanctions in response to the war to over 1,500.
The sanctions announcement coincided with the NATO Leaders’ Summit in The Hague, where Australia also deepened its operational cooperation with the alliance. Deputy Prime Minister and Defence Minister Richard Marles confirmed the deployment of a Royal Australian Air Force E-7A Wedgetail aircraft and up to 100 ADF personnel to Europe under Operation Kudu. The aircraft will assist in protecting a key humanitarian and military aid corridor into Ukraine, with the mission expected to conclude by November 2025.
China Condemns US Sanctions on Cuba as “Barbarian” and Calls for Immediate Reversal
China has issued a strong rebuke of the United States’ renewed sanctions policy toward Cuba, following reports that Donald Trump signed a National Security Presidential Memorandum on June 30 to reinstate hardline measures from his first term. In a press briefing, Chinese Foreign Ministry spokesperson Mao Ning condemned the US embargo and sanctions as “barbarian” and “illegal,” asserting that they have severely infringed on Cuba’s rights to subsistence and development over the past six decades.
Mao reiterated China’s firm opposition to unilateral sanctions imposed under the pretext of promoting freedom and democracy, and called on the US to immediately lift its blockade and remove Cuba from the list of state sponsors of terrorism. She emphasized that this position reflects the broader consensus of the international community and reaffirmed China’s support for Cuba’s sovereign right to pursue a development path suited to its national conditions.
