Russia arrests REvil ransomware’s 14 gang members

The Federal Security Service of the Russian Federation announced a joint effort with the Ministry of Internal Affairs of Russia that led to the arrest of 14 people associated with the infamous cybercrime group REvil ransomware.

The group was reportedly taken down last October by a multi-nation operation in which law enforcement officials and cyber specialists hacked into REvil's computer network infrastructure, taking control of some of its infrastructure. Since then, group members have been flying under the radar but clearly were still at large.

The FSB claimed those arrested had developed malicious software and organized the theft of funds from the bank accounts of foreign citizens and cashed them out, including by purchasing expensive goods on the Internet.

The arrested individuals were charged with committing crimes under Part 2 of Article 187 "Illegal circulation of means of payment" of the Criminal Code of Russia. The FSB said, “The organized criminal association has ceased to exist, and the information infrastructure used for criminal purposes was neutralized.”

The FSB said that the investigation came at "the request of competent US authorities," who were later "informed about the results of the operation."

The FSB might have also raided REvil knowing that the group was a high-priority target for the U.S. but that the arrests would have little impact on the current ransomware landscape. The operation may have even been staged as a warning to other ransomware gangs to be mindful of whom they target lest they invite undue attention to themselves.