US imposes further sanctions on Russian chemistry institute

A Russian chemistry institute has been targeted for further sanctions by the US government, as part of a larger attempt to make it harder for the country to continue its invasion of Ukraine. The Treasury Department announced on 31 March that it is going after Russian tech companies, including the Russian government-funded Central Scientific Research Institute of Chemistry and Mechanics (CNIIHM), with the aim of restricting the country’s access to resources essential to carrying out and financing its war.

Back in October 2020, the US sanctioned CNIIHM for its connection to the Triton malware that was used to attack a petrochemical facility in the Middle East in August 2017. These sanctions prohibited people in the US from conducting business with the institute. At the time, the US said CNIIHM built the customised software tools that enabled the cyber-attack, which tampered with the oil refinery’s critical safety mechanisms. Fortunately, the facility automatically defaulted to a failsafe shutdown, preventing the malware from beings fully deployed.

With its new announcement, the US is taking additional action against key CNIIHM employees including Evgeny Viktorovich Gladkikh, who works at the institute’s Applied Development Center (ADC). The US said that he and two others helped conduct computer intrusions that targeted energy facilities in the US and elsewhere.

On 24 March, the US Department of Justice unsealed Gladkikh’s indictment, which charged him with two counts of conspiracy to cause damage to an energy facility and conspiracy to commit computer fraud. That same day, the US State Department announced a $10 million (£7.6 million) reward for information on Gladkikh and his activities.

Beyond Gladkikh, on 31 March the Treasury also sanctioned CNIIHM employees Sergei Bobkov, the institute’s general director, and Konstantin Malevanyy, CNIIHM’s deputy general director and chief of the ADC. The two men played a crucial role in the 2017 Triton malware cyber-attack, the US said.

The latest action means that all property belonging to Gladkikh and others located in the US can be seized. Furthermore, financial institutions and others that have transactions with the sanctioned institute and individuals may themselves be subject to sanctions.