Russia-based ransomware gang offline but cause not clear
The Russia-based criminal syndicate behind a devastating series of recent ransomware attacks is offline
Your support helps us to tell the story
From reproductive rights to climate change to Big Tech, The Independent is on the ground when the story is developing. Whether it's investigating the financials of Elon Musk's pro-Trump PAC or producing our latest documentary, 'The A Word', which shines a light on the American women fighting for reproductive rights, we know how important it is to parse out the facts from the messaging.
At such a critical moment in US history, we need reporters on the ground. Your donation allows us to keep sending journalists to speak to both sides of the story.
The Independent is trusted by Americans across the entire political spectrum. And unlike many other quality news outlets, we choose not to lock Americans out of our reporting and analysis with paywalls. We believe quality journalism should be available to everyone, paid for by those who can afford it.
Your support makes all the difference.The Russia-based criminal syndicate behind a devastating series of recent ransomware attacks was offline on Tuesday, but cybersecurity experts said that it was premature to speculate why and that there was no indication of a law enforcement takedown.
REvil’s dark web data-leak site and ransom-negotiating portals were both unreachable, cybersecurity researchers said. The group was responsible for the Memorial Day ransomware attack on the meat processor JBS and the supply-chain attack this month targeting the software company Kaseya that crippled well over 1,000 businesses globally.
President Joe Biden told Russian President Vladimir Putin on a call Friday that he needed to rein in attacks from Russia-based groups and warned that the U.S. had the right to defend its people and critical infrastructure from attacks.
But there were no immediate or public signs that the government had anything to do with REvil appearing offline. It was also possible that the group was laying low after the attack, or switching methods “as we did expose them," said threat researcher Ryan Sherstobitoff of SecurityScorecard.
“It could be that the server hardware failed, or that it was intentionally taken down, or that someone attacked their host,” said Sean Gallagher a threat researcher at the cybersecurity firm Sophos. He noted that REvil’s public ransom-negotiating site was also down last week.
Spokespeople for the White House and U.S. CyberCommand, the Pentagon's cyber arm, declined to comment on Tuesday.
“We have seen no indicators for either voluntary shutdown nor of any offensive steps from law enforcement," said Alex Holden, founder and chief information security officer of Hold Security. “Right now, perhaps, it is too early to speculate, especially as REvil was building up their strength over the recent months.”
"There is always a glimmer of hope that Russia is finally doing something right,” he added.
Ransomware variants have previously disappeared as the criminals behind them retooled and modified their malware before introducing it under a new guise. That’s what threat analysts believe happened with a precursor to the REvil ransomware-as-a-service software called Gandcrab. It was the most successful variant over a 15-month run that began in January 2018.