Ransomware Sanctions, OFAC, and the Lazarus Group: A Real Case Study

About this episode

This episode discusses ransomware sanctions and a real case study involving the Lazarus Group and a construction company facing a ransom demand.

Ransomware sanctions are something most companies never think about — until they're staring down a ransom demand from a group the US government has already put on a sanctions list. In this episode, Dr. Mike Saylor walks us through a real incident involving a construction company, hundreds of millions in active contracts, and the Lazarus Group — a North Korean state-sponsored threat actor. Before that company could pay a single dollar in ransom, they had to figure out whether doing so would trigger federal penalties that dwarfed the ransom itself. We're talking fines of 10x to 100x the payment amount, and in some jurisdictions, jail time. This is one of those episodes where the story alone is worth your time. Mike was in the room for this incident, negotiating directly with the Lazarus Group over a weekend — and yes, it turns out North Korean cybercriminals have a surprisingly functional help desk. But beyond the story, there's real actionable information here about OFAC (the Office of Foreign Asset Control), how the US Treasury tracks Bitcoin wallets to identify sanctioned actors, and what you actually need to do the moment ransomware hits your organization. We also get into why…

People in this episode

Host: W. Curtis Preston

Guest: Dr. Mike Saylor

Topics covered

• ransomware
• sanctions
• cybersecurity
• case study
• Lazarus Group
• OFAC
• Bitcoin tracking

Keywords

• ransomware
• sanctions
• Lazarus Group
• OFAC
• US Treasury
• Bitcoin
• immutable backups
• cybersecurity

Mentioned in this episode

Organizations: Lazarus Group, US Treasury, Office of Foreign Asset Control

Places: North Korea

More episodes of The Backup Wrap-Up

• California Election Counting Explained by an Actual Poll Worker · June 8, 2026 · 25 min
• Stop 90% of Ransomware Attacks with Basic Cyber Hygiene · May 25, 2026 · 40 min
• Claude Deletes a Company — But It's Not Really Claude's Fault · May 18, 2026 · 40 min
• How Honeypots and Canary Files Catch Attackers Before They Strike · May 11, 2026 · 34 min
• Network Segmentation to Prevent Ransomware: What the UCSF Attack Taught Us · May 4, 2026 · 47 min
• Stop Using VSS as a Backup Before Ransomware Deletes Your Shadow Copies · April 27, 2026 · 37 min