Russia shut down REvil gang hacker group & infrastructure 'liquidated

The notorious cybercrime group REvil was liquidated by the Russian authorities (FSB) and its 15 members were arrested. Moscow said the ransomware group REvil “ceased to exist” after raids and arrests .

REvil once named as "Crown prince of Ransomware", was responsible for the Kaseya supply chain attack, and many other high-profile breaches. However, it is not clear if the operation will ease tensions with Washington.

Russia’s main security agency, known as the F.S.B., said “the organized crime gang ceased to exist” after a sweeping operation that was carried out in 25 locations across five Russian regions. The raids followed multiple requests by the Biden administration for the Kremlin to help shut down such groups.

Interfax said the equivalent of over US$5 million was seized at the residences of 14 members of the hacker group, as well as computer equipment, crypto wallets and 20 premium cars.

The arrests were announced on the same day that the U.S. government accused Russia of sending saboteurs into Ukraine to create a pretext for invasion, and that hackers shut down dozens of Ukraine’s government websites - an attack that Ukrainian officials suggested had originated in Russia.

The F.S.B. did not say how many people it had arrested, or whether they included the group’s leaders. It remains to be seen whether the operation really spells the end of REvil; in the past, such groups have reformed under new names.

The arrests come as the United Nations is preparing to start a three-year discussion on January 17th on a possible cybercrime treaty. They also come seven months after U.S. president Joe Biden urged Russian President Vladimir Putin to crack down on cyber hackers based in his country.

U.S. officials have said that the Kremlin could shut down hacker groups like REvil, but tolerates or even encourages them, as long as their targets are outside of Russia.