EletiofeRussia Takes Down REvil Hackers—as Ukraine Tensions Mount

Russia Takes Down REvil Hackers—as Ukraine Tensions Mount

-

- Advertisment -

“I think being concerned about Russia’s ulterior motives [for conducting the REvil arrests] is perfectly reasonable,” says John Hultquist, vice president of threat intelligence at the security firm Mandiant. “This essentially is a feather in their cap and you could definitely take a cynical view of it and think that it’s all signaling. But I think ultimately it’s still good news. The actors needed to know that if you are harassing thousands of people and stealing hundreds of millions of dollars you can’t just ride off into the sunset.”

It isn’t the first time an alleged member of REvil has faced action from law enforcement. In November, 22-year-old Ukrainian national Yaroslav Vasinskyi was arrested in Poland and accused of conducting the Kaseya attack. Vasinskyi allegedly abused a Kaseya product to deploy REvil code that then spread the group’s ransomware via Kaseya’s networks, according to a Department of Justice indictment. Yevgeniy Polyanin, a 28-year-old Russian national, was also charged with deploying REvil’s ransomware—he’s accused of conducting 3,000 ransomware attacks—and had $6.1 million of his assets seized.

Law enforcement agencies around the world, including in Ukraine, have increasingly been working together in efforts to tackle ransomware actors. Since February 2021, Europol has arrested five hackers linked to REvil and says 17 countries have been working on its investigations. These include the US, UK, France, Germany, and Australia.

Without cooperation from Russia, though, officials have had some hard limits on which gangs they could effectively target. After hitting a zenith—or nadir—with a series of disruptive and destructive attacks in the summer of 2021, REvil mostly went dark after international law enforcement compromised its infrastructure. Other Russia-based groups, though, like the notorious DarkSide gang and its successor BlackMatter, have continued their targeting, at least for now.

“The big question, I suppose, is does this represent a real shift in Russia’s intentions to deal with this problem, or has REvil simply been sacrificed in an attempt to alleviate some international pressure?” says Brett Callow, a threat analyst at the antivirus company Emsisoft. “I would suspect the latter.”

Callow and others emphasize, though, that while it will take time to learn more about the Russian government’s approach, seeing so many REvil operators apprehended should provide some amount of deterrent effect. And in an interconnected industry like the ransomware market, every disruption is significant.

“I agree there must be a motivation other than ‘the US asked us nicely,’ but regardless, this will further disrupt the ransomware economy, at least in the short term,” says incident responder and former NSA hacker Jake Williams.

In the long term, several ransomware groups operating out of Russia remain highly active. The REvil takedown is a sign of progress, but what really matters will be the Kremlin’s appetite for pursuing those other gangs as well.


More Great WIRED Stories

Latest news

I’ll Love You Till The End Of Time – Adesua Etomi Pens Romantic Birthday Message To Husband, Banky W On His Birthday

Nigerian actress, Adesua Etomi has taken to Instagram to pen a heartfelt note to her husband, Banky W, as...

Tinubu Establishes Presidential Economic Coordination Council

President Bola Ahmed Tinubu has established the Presidential Economic Coordination Council (PECC).He also created the Economic Management Team Emergency...

Sophia Smith becomes NWSL’s highest-paid player with new Thorns extension

Sophia Smith became the latest NWSL star to ink a new deal Wednesday, becoming the league's highest-paid player in...

USWNT’s Midge Purce tears ACL, will miss Olympics and Gotham FC’s NWSL season

Midge Purce, a USWNT player and the reigning NWSL Championship Game MVP, will miss the rest of Gotham FC's...
- Advertisement -

Lionel Messi on retirement talk: ‘If I feel good, I will always try to continue competing’

Lionel Messi will turn 37 in June, but as long as his body feels good, he plans to play...

The Baltimore Bridge Collapse Is About to Get Even Messier

In the early hours of Tuesday morning, the global supply chain and US coastal infrastructure collided in the worst...

Must read

Tinubu Establishes Presidential Economic Coordination Council

President Bola Ahmed Tinubu has established the Presidential Economic...
- Advertisement -

You might also likeRELATED
Recommended to you