Full Report
The U.S. Treasury Department has imposed new sanctions on the Russia-linked A7 cryptocurrency platform, which Washington describes as a “shadow banking network…
Analysis Summary
# Threat Actor: A7 Payment Network (A7)
## Attribution & Identity
* **Actor Identification:** A7 is a Russia-linked cryptocurrency platform and "shadow banking network" designated by the U.S. Treasury as a significant transnational criminal organization.
* **Key Individuals:**
* **Ilan Shor:** Fugitive Moldovan oligarch (residing in Russia) identified as the network's operator.
* **Leonid Shumakov:** Head of the A7A5 stablecoin.
* **Mikhail Dorofeyev:** Deputy chairman of Promsvyazbank (PSB).
* **Associated Groups:**
* Promsvyazbank (PSB) - Russian state-owned bank.
* Iranian Central Bank and Islamic Revolutionary Guard Corps (IRGC).
* Hamas and other Tehran-backed groups.
* "Shadow fleet" participants (involved in Iranian oil/sanctions evasion).
* Various cybercriminal groups.
## Activity Summary
The A7 network functions as a large-scale illicit financial artery designed to bypass international sanctions. As of early 2026, it was reportedly processing over 2,000 transactions per day, facilitating the movement of billions of dollars (equivalent to ~13% of Russia’s 2025 foreign trade). Recent operations include the establishment of infrastructure in Africa (Nigeria) and facilitating weapons procurement and oil revenue transfers for Iranian-linked entities.
## Tactics, Techniques & Procedures
* **Shadow Banking:** Operates outside the regulated global financial system to provide liquidity to sanctioned states.
* **Subagent Network:** Utilizes a decentralized network of companies in third-party countries to facilitate transfers.
* **Document Falsification:** Creation of falsified trade documents to disguise illicit payments as legitimate commercial transactions.
* **Cryptocurrency Layering:** Utilization of digital assets and stablecoins to move funds rapidly across borders.
* **Infrastructure Expansion:** Opening physical offices in jurisdictions with emerging or less stringent financial oversight (e.g., Nigeria) to broaden the network's reach.
## Targeting
* **Sectors:** Financial services, Cryptocurrency, Defense/Weapons Procurement, Energy (Oil).
* **Geography:** Primarily Russia and Iran, with operations expanding into Africa (Nigeria) and utilizing subagents in various third-party countries globally.
* **Victims:** While not a traditional "threat actor" that targets victims for data theft, the primary victims are the integrity of the international financial system and the efficacy of global sanctions regimes.
## Tools & Infrastructure
* **Malware families used:** Not specified (actor focused on financial/transactional infrastructure rather than traditional malware).
* **Stablecoins:** A7A5 stablecoin.
* **Associated Entities:**
* A7 Agent
* A71
* Promsvyazbank (PSB)
* Yandex Bank (identified in related UK sanctions)
* **Infrastructure:** Physical presence in Nigeria; digital infrastructure capable of processing 7.5 trillion rubles ($91.5 billion) in transactions.
## Implications
A7 represents a strategic evolution in sanctions evasion, shifting from clandestine one-off transfers to a systemic "shadow banking" infrastructure. Its partnership with state-level actors (Russia and Iran) and paramilitary groups (IRGC, Hamas) suggests a centralized hub for financing geopolitical instability. The scale of the network—handling a double-digit percentage of a major nation's foreign trade—indicates a significant challenge to Western economic statecraft.
## Mitigations
* **Enhanced Due Diligence (EDD):** Banks and financial institutions should apply heightened scrutiny to transactions involving cryptocurrency platforms linked to Moldovan or Russian intermediaries.
* **Subagent Monitoring:** FinCEN recommends that banks utilize specific indicators to identify suspicious transactions linked to A7 subagents.
* **Blockchain Analytics:** Deployment of tools to monitor for A7A5 stablecoin activity and associated wallet addresses.
* **Trade Document Verification:** Increased rigor in verifying the authenticity of commercial trade documents from third-country intermediaries involved in Russian or Iranian trade.