Search the Community

In an unprecedented move, Russia's Federal Security Service (FSB), the country's principal security agency, on Friday disclosed that it arrested several members belonging to the notorious REvil ransomware gang and neutralized its operations. The surprise takedown, which it said was carried out at the request of the U.S. authorities, saw the law enforcement agency conduct raids at 25 addresses in the cities of Moscow, St. Petersburg, Moscow, Leningrad and Lipetsk regions that belonged to 14 suspected members of the organized cybercrime syndicate. "In order to implement the criminal plan, these persons developed malicious software, organized the theft of funds from the bank accounts of foreign citizens and their cashing, including through the purchase of expensive goods on the Internet," the FSB said in a statement. In addition, the FSB seized over 426 million rubles, including in cryptocurrency, $600,000, €500,000, as well as computer equipment, crypto wallets used to commit crimes, and 20 luxury cars that were purchased with money obtained by illicit means. One of the most active ransomware crews last year, REvil took responsibility for high-profile attacks against JBS and Kaseya, among a string of several others. The U.S. government told Reuters that one of the arrested individuals was also behind the ransomware attack on Colonial Pipeline in May 2021, once again confirming REvil's connections to a second collective called DarkSide. The group formally closed shop in October 2021 after the U.S. intervened to take its network of dark web servers offline. The next month, law enforcement authorities announced the arrest of seven individuals for their roles as affiliates of the REvil ransomware family, even as the U.S. charged a 22-year-old Ukrainian citizen linked to the ransomware gang for orchestrating the Kaseya ransomware attack. All those detained have been charged with "illegal circulation of means of payment," a criminal offense punishable by up to six years in prison. The suspects weren't named, but Reuters noted that a Moscow court identified two of the men as Roman Muromsky and Andrei Bessonov. The crackdown also comes as threat actors likely affiliated with Russian secret services crippled much of the Ukrainian government's public-facing digital infrastructure, in addition to defacing some of them with messages that alleged people's personal data had been made public and that the information stored in the servers was being destroyed. It remains to be what impact the arrests will have on the larger ransomware ecosystem, which has by and large continued to flourish despite a number of law enforcement actions, partly driven by Russia's willingness to look the other way when it comes to harboring cybercriminals in the country, effectively allowing the bad actors to operate with impunity. "While we are still looking to understand the true impact of these arrests, we applaud the Russian government for the actions it took today with regard to the REvil criminal ransomware group," Matt Olney, director of threat intelligence and interdiction at Cisco Talos, told The Hacker News. "It's important that criminal cyber actors and organizations not be allowed to operate with impunity. And so any result that leads to degrading of their capabilities is undoubtedly a good thing." Source

A global police operation has dealt a devastating blow to one of the most prolific cyber-crime gangs in history. The co-ordinated action against the REvil gang was announced on Monday by Romanian police, the US Department of Justice (DOJ) and Europol. The raids, which took place both on and offline, led to the arrests of two alleged hackers in Romania and one from Ukraine. REvil has been blamed for major hacks on global businesses in recent years. The US also announced that it had successfully retrieved more than $6m (£4m) in cryptocurrency from the gang in a so-called "claw back" hacking operation. For the last three years REvil - which used to call itself GandCrab and is also known as Sodinikobi - has been attacking businesses and institutions around the world. Europol's operation, named GoldDust, was set up specifically to tackle the group. Since February the operation has led to 7 arrests of the hacker gang in total in Romania, Ukraine, South Korea and Kuwait. Officers allege that the two Romanians arrested on November 4th infected 5,000 victims and pocketed half a million euros in ransom payments. In recent weeks the leaders of REvil announced that pressure from authorities had forced them to shut down operations. High-profile victims Back in May, REvil's ransomware targeted the world's largest meat processor, JBS SA, disrupting meat production for several days. The company ultimately paid $11m to the hackers. The group's malware also caused months of disruption to foreign exchange company Travelex, which had all computer systems offline for weeks. Most recently, the gang successfully hacked Florida-based software firm Kaseya which subsequently infected up to 1,500 businesses around the world. Ransomware gang websites disappear from internet The ransomware surge ruining lives Should paying hacker ransoms be illegal? The US Treasury Department said more than $200m in ransom payments were paid in Bitcoin and Monero in the attack. The DOJ says Yaroslav Vasinskyi, 22, a Ukrainian man arrested in Poland last month, was responsible and has indicted him. The US is seeking to extradite him for trial in America. Another alleged REvil operative, Russian Yevgeniy Polyanin, 28, has also been charged by the US with conspiracy to commit fraud, and conspiracy to commit money laundering, among other charges. Russia is unlikely to extradite its own citizen to the US, so Mr Polyanin is expected to join a growing list of wanted alleged Russian hackers. The Treasury Department added that the two men face sanctions for their alleged role in ransomware incidents in the United States. Court documents also accused a virtual cryptocurrency exchange called Chatex of "facilitating financial transactions for ransomware actors". FBI Director Christopher Wray told reporters on Monday: "The long arm of the law reaches a lot further than they think. 'The cyber threat is daunting, but when we combine the right people, the right tools and the right authority, our adversaries are no match for what we can accomplish together." Source