World News

Russia-Based Ransomware Gang Behind Recent Attacks Goes Offline, But Its Not Clear Why

The Russia-based criminal syndicate behind a devastating series of recent ransomware attacks was offline on Tuesday, but cybersecurity experts said that it was premature to speculate why and that there was no indication of a law enforcement takedown.

REvil’s dark web data-leak site and ransom-negotiating portals were both unreachable, cybersecurity researchers said. The group was responsible for the Memorial Day ransomware attack on the meat processor JBS and the supply-chain attack this month targeting the software company Kaseya that crippled well over 1,000 businesses globally.

President Joe Biden told Russian President Vladimir Putin on a call Friday that he needed to rein in attacks from Russia-based groups and warned that the U.S. had the right to defend its people and critical infrastructure from attacks.

But there were no immediate or public signs that the government had anything to do with REvil appearing offline. It was also possible that the group was laying low after the attack, or switching methods “as we did expose them,” said threat researcher Ryan Sherstobitoff of SecurityScorecard.

“It could be that the server hardware failed, or that it was intentionally taken down, or that someone attacked their host,” said Sean Gallagher, a threat researcher at the cybersecurity firm Sophos. He noted that REvil’s public ransom-negotiating site was also down last week.

Spokespeople for the White House and U.S. CyberCommand, the Pentagon’s cyber arm, declined to comment on Tuesday.

“We have seen no indicators for either voluntary shutdown nor of any offensive steps from law enforcement,” said Alex Holden, founder and chief information security officer of Hold Security. “Right now, perhaps, it is too early to speculate, especially as REvil was building up their strength over the recent months.”

“There is always a glimmer of hope that Russia is finally doing something right,” he added.

Ransomware variants have previously disappeared as the criminals behind them retooled and modified their malware before introducing it under a new guise. That’s what threat analysts believe happened with a precursor to the REvil ransomware-as-a-service software called Gandcrab. It was the most successful variant over a 15-month run that began in January 2018.

In 2019, a ransomware attack wiped out 750 government computers across Texas in less than 90 minutes. As hospitals, local governments, agencies and businesses increasingly become the targets of ransomware attacks, here’s what you should know about the threat.

New England Cable News

New England Cable News is a regional 24-hour cable news television network owned and operated by NBCUniversal serving the New England region of the United States. It focuses on regional news, though in some low priority timeslots, paid programming and programming from WNBC such as Talk Stoop and Open House are seen.

Related Articles

Back to top button