EletiofeRussia Takes Down REvil Hackers—as Ukraine Tensions Mount

Russia Takes Down REvil Hackers—as Ukraine Tensions Mount


- Advertisment -

“I think being concerned about Russia’s ulterior motives [for conducting the REvil arrests] is perfectly reasonable,” says John Hultquist, vice president of threat intelligence at the security firm Mandiant. “This essentially is a feather in their cap and you could definitely take a cynical view of it and think that it’s all signaling. But I think ultimately it’s still good news. The actors needed to know that if you are harassing thousands of people and stealing hundreds of millions of dollars you can’t just ride off into the sunset.”

It isn’t the first time an alleged member of REvil has faced action from law enforcement. In November, 22-year-old Ukrainian national Yaroslav Vasinskyi was arrested in Poland and accused of conducting the Kaseya attack. Vasinskyi allegedly abused a Kaseya product to deploy REvil code that then spread the group’s ransomware via Kaseya’s networks, according to a Department of Justice indictment. Yevgeniy Polyanin, a 28-year-old Russian national, was also charged with deploying REvil’s ransomware—he’s accused of conducting 3,000 ransomware attacks—and had $6.1 million of his assets seized.

Law enforcement agencies around the world, including in Ukraine, have increasingly been working together in efforts to tackle ransomware actors. Since February 2021, Europol has arrested five hackers linked to REvil and says 17 countries have been working on its investigations. These include the US, UK, France, Germany, and Australia.

Without cooperation from Russia, though, officials have had some hard limits on which gangs they could effectively target. After hitting a zenith—or nadir—with a series of disruptive and destructive attacks in the summer of 2021, REvil mostly went dark after international law enforcement compromised its infrastructure. Other Russia-based groups, though, like the notorious DarkSide gang and its successor BlackMatter, have continued their targeting, at least for now.

“The big question, I suppose, is does this represent a real shift in Russia’s intentions to deal with this problem, or has REvil simply been sacrificed in an attempt to alleviate some international pressure?” says Brett Callow, a threat analyst at the antivirus company Emsisoft. “I would suspect the latter.”

Callow and others emphasize, though, that while it will take time to learn more about the Russian government’s approach, seeing so many REvil operators apprehended should provide some amount of deterrent effect. And in an interconnected industry like the ransomware market, every disruption is significant.

“I agree there must be a motivation other than ‘the US asked us nicely,’ but regardless, this will further disrupt the ransomware economy, at least in the short term,” says incident responder and former NSA hacker Jake Williams.

In the long term, several ransomware groups operating out of Russia remain highly active. The REvil takedown is a sign of progress, but what really matters will be the Kremlin’s appetite for pursuing those other gangs as well.

More Great WIRED Stories

Latest news


'Good Time,' 'Personal,' 'Number One,' 'Koni Koni' and 'Goodness and Mercy' are such amazing record with high calibre replay...

‘Zero-Click’ Zoom Vulnerabilities Could Have Exposed Calls

Most hacks require the victim to click on the wrong link or open the wrong attachment. But as so-called...

Brother Who Defiled His Sister For Years In Family Home Is Jailed

A Central Criminal Court has sentenced a man to seven years imprisonment after he repeatedly had unlawful carnal...

Man Drugged And Blindfolded His N*ked Wife So His Colleague Could R*pe Her

The Singapore Supreme Court has heard the harrowing story of a man who drugged and blindfolded his wife of...
- Advertisement -

I Started Smoking Because I Was Depressed – Toyin Abraham Opens Op On Life Challenges

Nigerian actress and filmmaker, Toyin Abraham has opened up on her struggles in the past which turned her into...

I’ve Been Receiving Threat Messages For Not Supporting Tinubu’s Ambition – Buhari’s Aide, Ojudu

Ojudu The Special Adviser to the President on Political Matters, Babafemi Ojudu has cried...

Must read


'Good Time,' 'Personal,' 'Number One,' 'Koni Koni' and 'Goodness...

‘Zero-Click’ Zoom Vulnerabilities Could Have Exposed Calls

Most hacks require the victim to click on the...
- Advertisement -

You might also likeRELATED
Recommended to you