Well, this is big! The FSB arrests 14 members of the REvil Ransomeware gang across Russia!

[thewayne]

Normally the rule is that as long as you're based in Russia and you don't attack Russian and most Eastern European countries, that you're good. So what exactly happened here?

The Russian Federal Security Service (FSB) said today that it has raided and shut down the operations of the REvil ransomware gang. Raids were conducted today at 25 residents owned by 14 members suspected to be part of the REvil team across Moscow, St. Petersburg, Leningrad, and the Lipetsk regions. Authorities said they seized more than 426 million rubles, $600,000, and 500,000 euro in cash, along with cryptocurrency wallets, computers, and 20 expensive cars. The REvil gang is responsible for ransomware attacks against Apple supplier Quanta, Kaseya, and JBS Foods.

Apparently American and other country's pressure on Russia produced some results, at last! If this were a movie, Jason Bourne (or equivalent) would be sneaking into Russian hacker farms and wiping them out with a silenced pistol, but we don't do things like that. It will be interesting to see how these prosecutions and prison sentences play out.

https://therecord.media/fsb-raids-revil-ransomware-gang-members/

https://it.slashdot.org/story/22/01/14/154259/fsb-arrests-14-members-of-revil-ransomware-gang

Comments

[elayna]

Possibly it was the pressure from other countries, but I can't help wondering if the FSB decided they needed a cash infusion. It wouldn't surprise me if Russia impounds property from criminals just as much as America does.

[thewayne]

Russia and Putin's buds have probably been hurting for hard cash, so that could have been part of it.    Easy way for "two birds, one stone" solution.

[murakozi]

Or maybe the ones who were arrested were behind in their 'insurance' payments to the FSB.

[moxie_man]

Beat me to it.

[armiphlage]

Certain individuals who may or may not have been affiliated with GRU Unit 74455 recently really, really infuriated Prince Mohammed bin Salman by getting his personal information. They immediately issued a public statement apologizing to him by name and promised they deleted every byte. That was not sufficient atonement for what an entitled, malicious royal considered to be a personal attack. This is someone who for less-personal reasons has no qualms having journalists dismembered, and who has his agents fly to Canada to intimidate the kids of a former Saudi intelligence officer.

Petroleum giant Rosneft (6% of global production) would suffer if a disgruntled Saudi Arabian crown prince increased oil production out of spite.

Officially, 40.4% of Rosneft's declared profits go directly to the Russian government.

A very public and harsh takedown of a plausible scapegoat will make Saudi Arabia and Russia happy. Placating all the the other countries irritated by the scapegoat is a bonus.

[thewayne]

Very interesting!  I hadn't heard that MBS had gotten hacked, much as I love it!  That explains a lot.  Of course all phones are vulnerable, as are all computers that are online.  Yeah, an action like this could mend a lot of fences.

[armiphlage]

https://www.hackread.com/conti-ransomware-gang-sorry-arab-royals-data-leak/

[thewayne]

That is an amazing story!  I'm going to look a bit deeper into it.

Wowwwww.

[kathmandu]

Yay! Any day that ransomware bad-guys take a fall is a good day.

[dewline]

An entertaining bit of news, although I'm not counting on safety from their competitors.

[thewayne]

No, of course not.  See Armiphlage's reply beneath yours: very interesting take on the event!  It's entirely possible that this was a sacrifice and some key members may still be online.

[captainsblog]

Maybe Vlad's afraid of US retribution now that he doesn't have his loyal trusted employee answering the red phone.

[silveradept]

I mean, it's nice to see this public raid, but I'm pretty sure the FSB knows where most of the other gangs are. I'd feel like they were serious about the problem if all of those guys started disappearing, too.

[thewayne]

REvil made themselves really visible, most of the other gangs keep a much lower profile.  The nail that stands up....

[silveradept]

Yeah, that makes sense. It's a futile hope if what they want get out of this bust is people not remembering that a whole body of others have also set up in that country, assuming they're not GRU units or approved by them.