Categories: Ransomware

Russia Arrests Hackers Behind REvil Ransomware & Shutdown Operations

At the request of the United States, the Federal Security Service (FSB) has recently arrested all the hackers behind the REvil ransomware group and claimed to have completely shut down all operations of the group.

The closure of the REvil ransomware gang comes after a Ukrainian citizen was arrested in Poland last November for using REvil ransomware to attack company computers and demand large ransoms of about 6 million dollars that are grasped by the hackers to release the stored information of the targeted companies.

With 25 police raids, Russia has completed the operation after receiving the request from the authorities of the United States, and during the raids, the FSB arrested 14 people.

All these 25 raids were performed in the following places:-

  • St. Petersburg
  • Moscow
  • Leningrad
  • Lipetsk regions

Among those 14 arrested people, they also found the leader of the group, who not only directed the ransomware attacks but also stole money from bank accounts of foreign citizens in Russia.

After facing such issues, finally, President Joe Biden requested Vladimir Putin (the President of Russia) last summer to start the seizure operation; however, the FSB clarifies that REvil members with Russian citizenship will not be deported to the United States.

Seizure

As part of the operation, Russian agents have seized the following things that were obtained with the money from the ransoms and thefts:-

  • More than 6 million euros
  • Various currencies
  • Computer equipment
  • Cryptocurrency wallets
  • Over 426 million rubles
  • $600 thousand
  • 20 premium and luxury cars

After organizing the largest ransomware operation in history and this seizure, the REvil ransomware became the most wanted hacker group on the planet.

Their operations have affected more than 1500 companies and businesses around the globe whose servers were hacked by the operators of this group. Not only that, even the group also asked those companies to pay $70 million as a ransom for the release. 

However, these operations were the most recent and might be the last of many such attacks. Unlike other groups, the REvil hacker group had an inclination for flashy attacks, and they were not shy about announcing their accomplishments on their official “Dark Web” portal. 

Apart from this, among all its victims, Apple is also on the list who saw several blueprints for its new products like the new iMac and new MacBook Pro were posted on the internet. 

While they also asked for $42 million from the then US president, Donald Trump Jr., not to make the seized data public, and in this case, they managed to hack this data from the systems of the lawyer of Donald Trump Jr.

Moreover, to make the group most wanted on the planet the US government has also played a vital role by offering rewards of up to $10 million for the information from its members.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates

Balaji

BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Recent Posts

Hackers Exploiting DNS Poisoning to Compromise Active Directory Environments

A groundbreaking technique for Kerberos relaying over HTTP, leveraging multicast poisoning, has been recently detailed…

2 hours ago

New Android Malware Exploiting Wedding Invitations to Steal Victims WhatsApp Messages

Since mid-2024, cybersecurity researchers have been monitoring a sophisticated Android malware campaign dubbed "Tria Stealer,"…

2 hours ago

500 Million Proton VPN & Pass Users at Risk Due to Memory Protection Vulnerability

Proton, the globally recognized provider of privacy-focused services such as Proton VPN and Proton Pass,…

2 hours ago

Arcus Media Ransomware Strikes: Files Locked, Backups Erased, and Remote Access Disabled

The cybersecurity landscape faces increasing challenges as Arcus Media ransomware emerges as a highly sophisticated…

2 hours ago

Hackers Impersonate Top Tax Firm with 40,000 Phishing Messages to Steal Credentials

Proofpoint researchers have identified a marked increase in phishing campaigns and malicious domain registrations designed…

2 hours ago

Cybercriminals Exploit Public-Facing IIS, Apache, and SQL Servers to Breach Gov & Telecom Systems

A recent investigation by Unit 42 of Palo Alto Networks has uncovered a sophisticated, state-sponsored…

2 hours ago