US News

Russia shuts down REvil ransomware group as Ukraine tensions grow

Russia has arrested and charged several members of the ransomware crime group REvil at the request of the United States, authorities announced Friday amid growing tensions between the two Cold War adversaries over Ukraine. 

Russia’s FSB intelligence bureau said REvil “has ceased to exist,” but there was no indication that any of the suspects would be extradited to the US.

Officials said the investigation stemmed from an American request, with the arrests coming two months after federal officials in Washington offered a $10 million reward for information leading to the identification or location of REvil members.

FSB worked with local police to search 25 addresses, the bureau revealed, adding that it detained 14 people and seized assets including 426 million rubles; $600,000; 500,000 euros; computer equipment; and 20 luxury cars, according to Reuters

Russia’s FSB intelligence bureau conducted an operation to arrest several members of the ransomware crime group REvil. FSB of Russia/east2west news

REN TV, a Russian free-to-air television channel, aired footage of authorities raiding homes and arresting suspects. 

The FSB has informed US officials of the outcome, the outlet reported. 

Members of the ransomware group who have been arrested could face up to seven years in prison. 

FSB seized assets including 426 million rubles; about $600,000. FSB of Russia/east2west news

In recent years, the US has been hit several times by cyberattacks from crime organizations largely thought to be based in Russia or that have the backing of the Russian state. 

Last summer, REvil appeared to take responsibility for a cyberattack that affected more than 200 US companies, demanding $70 million in bitcoin to release the data. Not long after, the crime organization vanished from the web.

At the time, President Biden called on Russian President Vladimir Putin to take strong action against the hackers. 

Russian officials said the investigation stemmed from an American request. FSB of Russia/east2west news

“I made it very clear to him that the United States expects when a ransomware operation is coming from his soil, even though it’s not sponsored by the state, we expect him to act,” Biden told reporters following a mid-July call with Putin.

REvil is also believed to be behind a cyberattack on JBS Foods in June, which shut down all of the company’s US beef plants.

The arrests come amid a standoff over Ukraine. Moscow has pressed the US and NATO not to allow Kiev to join the Atlantic alliance, while the US has called Russia’s demands “non-starters.”

Earlier this week, talks involving the US, Russia, and NATO ended in a stalemate.

Friday afternoon, the White House revealed that it had intelligence suggesting Russian operatives have been deployed to conduct a “false flag” attack in eastern Ukraine that will act as a signal for Moscow to invade.