Threat reportThreat IntelligenceTL-2026-3514
U.K. Sanctions Cryptomus (Heleket) Crypto Payment Platform for Russian Money Laundering
U.K. Sanctions Cryptomus (Heleket) Crypto Payment Platform (TL-2026-3514), also tracked as Cryptomus, is a medium-severity tracked intrusion set, first published 2026-10-14. It is linked to a Russia-nexus actor with medium confidence, affects Xeltox Enterprises Ltd Cryptomus / Heleket / Certa Payments crypto, maps to 5 MITRE ATT&CK techniques (T1583.001, T1583.003, T1585), and is covered by 9 detection rules and 26 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 26Indicators of compromise
Key facts for TL-2026-3514
- Threat ID
- TL-2026-3514
- Also known as
- Cryptomus, Heleket, Certa Payments, Xeltox Enterprises, Handy Elect LLC
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- THREAT_INTEL
- First published
- Last reviewed
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Russia
- Motivation
- FINANCIAL
- Target sectors
- finance, cryptocurrency, government administration
- Target regions
- russia, kyrgyzstan, canada, Europe
- Detection rules
- 9
- Indicators of compromise
- 26
How U.K. Sanctions Cryptomus (Heleket) Crypto Payment Platform works
On October 8, 2026 the U.K. designated Xeltox Enterprises (operator of Cryptomus, Heleket and Certa Payments) alongside TokenSpot, Tsunami Payments and Processing KG (VexPay) for supporting the Russian financial sector and the A7 sanctions-evasion network. Cryptomus/Heleket were previously fined CAD $176.96M by Canada's FINTRAC and are assessed by Chainalysis and TRM Labs as major hubs for illicit flows.
On October 8, 2026 the U.K. FCDO announced 38 new Russia-related designations. Among them was Xeltox Enterprises Ltd (Vancouver-registered), designated through its ownership of the Cryptomus payment platform and activity 'linked to and continued via' its rebrand Heleket. Cryptomus has also operated as Certa Payments; Heleket is incorporated as Handy Elect LLC in Georgia per TRM Labs. TRM Labs reports Cryptomus processed roughly USD 7 billion between 2022 and 2025 (USD 8.2 billion total as of March 2026), including exposure to CSAM vendors, terrorist financing, human trafficking, sanctions evasion, Russian darknet markets, cybercrime service providers and ransomware-as-a-service operations.
TRM Labs documents shared infrastructure, branding, personnel, identical 0.4% processing fees, a shared privacy-focused domain registrar and common terminology between Cryptomus and Heleket. Heleket launched in January 2025, the month before Cryptomus introduced KYC (February 2025), and received initial funding from sanctioned exchange Garantex on January 16, 2025; cybercrime actors, including CSAM vendors, migrated from Cryptomus to Heleket. Heleket's 2025 illicit inflow ratio was about 0.6%, nearly five times the payment-processor average, with sanctions-related entities (primarily Garantex) making up 60% of it. TRM also counted more than 75,000 transactions with Iranian exchanges, over 50,000 with Nobitex. Chainalysis found Cryptomus and Heleket received funds from more than 15,000 illicit actors and 'more illicit funds across tracked categories than the mixers in our dataset'; the services were advertised on criminal forums (BHF, Nulled) as anonymous and KYC-free. Illicit sources include proceeds of the Bybit exploit (Lazarus Group), Black Basta ransomware and bulletproof-hosting vendors (Zservers, Stark Industries, First VPN, Aeza Group).
The same package designated TokenSpot CJSC and Tsunami Payments LLC (both in Tower B, 125/1 Toktogul Street, Bishkek) and OJSC Processing KG, operator of VexPay (parent: Kyrgyz Ministry of Finance) and its director Ulan Bukabaev. TokenSpot is assessed as a front for sanctioned exchange Grinex; its TRON addresses handled USD 3.54 billion received and 3.14 billion sent between Dec 2023 and Sept 2026, with large flows with the A7 network (the ruble-backed A7A5 stablecoin ecosystem). Two of the designated entities processed transactions with A7. Designation grounds: supporting the Russian financial services sector, facilitating A7 transactions, circumventing sanctions, and business of economic significance to the Russian government.
Prior regulatory action: on October 16, 2025 FINTRAC fined Xeltox Enterprises CAD $176,960,190 for failing to report suspicious transactions involving CSAM trafficking, fraud, ransomware payments and sanctions evasion; KrebsOnSecurity and analyst Richard Sanders documented 122 cybercrime services using Cryptomus and a Vancouver address listed by dozens of non-operating money service businesses. KrebsOnSecurity also reports that a sole shareholder of Certa Payments' parent is a 25-year-old Ukrainian woman and that fake 'Western Sahara' regulator domains were used to lend licensing credibility. Defenders should screen all brand names (Cryptomus, Heleket, Certa Payments, Xeltox), treat TokenSpot and Grinex addresses equivalently, and watch for successor platforms sharing infrastructure or liquidity. There is no CVE or exploit; severity is an analyst assessment of financial-crime and sanctions-compliance relevance.
MITRE ATT&CK techniques used in TL-2026-3514
Resource Development
T1583.001 Domains; T1583.003 Virtual Private Server; T1585 Establish Accounts
Impact
Defense Evasion
Affected products and versions in U.K. Sanctions Cryptomus (Heleket) Crypto Payment Platform
- Xeltox Enterprises Ltd — Cryptomus / Heleket / Certa Payments crypto payment processing
Vulnerable versions: all
Remediation for U.K. Sanctions Cryptomus (Heleket) Crypto Payment Platform
Immediate actions
- Screen customers, counterparties and wallet exposure against the U.K. OFSI Russia sanctions notice of 8 October 2026 (Xeltox Enterprises, Cryptomus, Heleket, Certa Payments, TokenSpot, Tsunami Payments, Processing KG/VexPay)
- Block or flag payments routed through Cryptomus, Heleket, TokenSpot and Grinex-linked TRON addresses
- Apply identical treatment to TokenSpot and Grinex wallet addresses per TRM Labs guidance
Longer-term hardening
- Use blockchain analytics (Chainalysis, TRM Labs) to monitor indirect exposure to successor platforms sharing infrastructure or liquidity with designated entities
- Review ransomware and fraud payment-tracing playbooks for Heleket/Cryptomus deposit addresses
Timeline of U.K. Sanctions Cryptomus (Heleket) Crypto Payment Platform
- U.K. designates Garantex, later a major liquidity counterparty of Cryptomus and Heleket
- KrebsOnSecurity/Richard Sanders research identifies 122 cybercrime services using Cryptomus
- Heleket receives initial funding from Garantex shortly after launch (TRM Labs)
- Cryptomus implements KYC; monthly on-chain volume falls from USD 153M (Jan 2025) to USD 86M (Mar 2025)
- FINTRAC fines Xeltox Enterprises (Cryptomus) CAD $176,960,190 for failing to report suspicious transactions
- TRM Labs publishes Cryptomus profile linking it to Heleket; USD 7B+ processed 2022-2025
- U.K. designates Rapira and A7-network infrastructure; Rapira later the largest sanctioned counterparty of Heleket
- TRM Labs assesses TokenSpot as front company for Grinex
- U.K. FCDO announces 38 Russia designations incl. Xeltox Enterprises (Cryptomus/Heleket), TokenSpot, Tsunami Payments, Processing KG (VexPay)
- KrebsOnSecurity publishes report on the Cryptomus sanctions
Sources cited for U.K. Sanctions Cryptomus (Heleket) Crypto Payment Platform
- U.K. Sanctions Cryptomus for RU Money Laundering (KrebsOnSecurity)
- U.K. Sanctions Notice: Russia, 8 October 2026
- Chainalysis: UK Sanctions Cryptomus, Heleket, TokenSpot
- TRM Labs: UK Sanctions Cryptomus, Heleket, and TokenSpot in New Russia Package
- TRM Labs Intel Library: Cryptomus
- Canada Fines Cybercrime-Friendly Cryptomus $176M (KrebsOnSecurity)
- How Cryptocurrency Turns to Cash in Russian Banks (KrebsOnSecurity)
- Decrypt: UK Targets Cryptomus and TokenSpot in New Russia Sanctions Package
Detection coverage for TL-2026-3514
As of 2026-10-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3514 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.