Monday, February 17, 2025
HomeRansomwareRussia Arrests Hackers Behind REvil Ransomware & Shutdown Operations

Russia Arrests Hackers Behind REvil Ransomware & Shutdown Operations

Published on

SIEM as a Service

Follow Us on Google News

At the request of the United States, the Federal Security Service (FSB) has recently arrested all the hackers behind the REvil ransomware group and claimed to have completely shut down all operations of the group.

The closure of the REvil ransomware gang comes after a Ukrainian citizen was arrested in Poland last November for using REvil ransomware to attack company computers and demand large ransoms of about 6 million dollars that are grasped by the hackers to release the stored information of the targeted companies.

With 25 police raids, Russia has completed the operation after receiving the request from the authorities of the United States, and during the raids, the FSB arrested 14 people.

All these 25 raids were performed in the following places:-

  • St. Petersburg
  • Moscow
  • Leningrad
  • Lipetsk regions

Among those 14 arrested people, they also found the leader of the group, who not only directed the ransomware attacks but also stole money from bank accounts of foreign citizens in Russia.

After facing such issues, finally, President Joe Biden requested Vladimir Putin (the President of Russia) last summer to start the seizure operation; however, the FSB clarifies that REvil members with Russian citizenship will not be deported to the United States.

Seizure

As part of the operation, Russian agents have seized the following things that were obtained with the money from the ransoms and thefts:-

  • More than 6 million euros
  • Various currencies
  • Computer equipment
  • Cryptocurrency wallets
  • Over 426 million rubles
  • $600 thousand
  • 20 premium and luxury cars

After organizing the largest ransomware operation in history and this seizure, the REvil ransomware became the most wanted hacker group on the planet.

Their operations have affected more than 1500 companies and businesses around the globe whose servers were hacked by the operators of this group. Not only that, even the group also asked those companies to pay $70 million as a ransom for the release. 

However, these operations were the most recent and might be the last of many such attacks. Unlike other groups, the REvil hacker group had an inclination for flashy attacks, and they were not shy about announcing their accomplishments on their official “Dark Web” portal. 

Apart from this, among all its victims, Apple is also on the list who saw several blueprints for its new products like the new iMac and new MacBook Pro were posted on the internet. 

While they also asked for $42 million from the then US president, Donald Trump Jr., not to make the seized data public, and in this case, they managed to hack this data from the systems of the lawyer of Donald Trump Jr.

Moreover, to make the group most wanted on the planet the US government has also played a vital role by offering rewards of up to $10 million for the information from its members.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Ransomware Gangs Encrypt Systems 17 Hours After Initial Infection

Ransomware gangs are accelerating their operations, with the average time-to-ransom (TTR), the period between...

Stealthy Malware in WordPress Sites Enables Remote Code Execution by Hackers

Security researchers have uncovered sophisticated malware targeting WordPress websites, leveraging hidden backdoors to enable...

Xerox Printer Vulnerability Exposes Authentication Data Via LDAP and SMB

A critical security vulnerability in Xerox’s Versalink C7025 Multifunction Printer (MFP) has been uncovered,...

New XCSSET Malware Targets macOS Users Through Infected Xcode Projects

Microsoft Threat Intelligence has identified a new variant of the XCSSET macOS malware, marking...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

Palo Alto Firewall Flaw Exploited in RA World Ransomware Attacks

A recent ransomware attack leveraging a vulnerability in Palo Alto Networks' PAN-OS firewall software...

ZeroLogon Ransomware Exploits Windows AD to Hijack Domain Controller Access

A newly intensified wave of ransomware attacks has surfaced, leveraging the infamous ZeroLogon vulnerability...

Cl0p Ransomware Hide Itself on Compromised Networks After Exfiltrate the Data

The Cl0p ransomware group, a prominent player in the cybercrime landscape since 2019, has...