REvil, Hacking Group Behind Major Ransomware Attack, Disappears

Just days after President Biden called President Vladimir V. Putin of Russia and demanded that he act to shut down ransomware groups tha...

Just days after President Biden called President Vladimir V. Putin of Russia and demanded that he act to shut down ransomware groups that are attacking American targets, the most aggressive of the groups suddenly went off-line early Tuesday morning, terminating negotiations over ransom payments and even bringing down the page where it boasted about its most successful extortion schemes.

The mystery is who made that happen.

The group, called REvil, short for “Ransomware evil,” has been identified by U.S. intelligence agencies as responsible for the attack that brought down one of America’s largest beef producers, JBS. Two weeks after Mr. Biden and Mr. Putin met in Geneva last month, REvil took credit for a hack that affected thousands of businesses around the world over the July 4 holiday.

That latest attack led to Mr. Biden’s ultimatum in a phone call on Friday to the Russian president. Later, Mr. Biden said “we expect them to act,” and when asked by a reporter later if he would take down the group’s servers if Mr. Putin did not, the president simply said, “Yes.”

He may have done exactly that. But that is only one possible explanation for what happened around 1 a.m. Eastern time on Tuesday, when the group’s sites on the dark web suddenly disappeared. Gone was the publicly available “happy blog’’ that the group maintained, listing its victims, and internet security groups said the custom-made sites where victims negotiate with REvil over how much they will pay to get their data unlocked were also missing.

While their disappearance was celebrated by many who see ransomware as a new scourge, one that Mr. Biden has called a critical national security threat, it left some of the group’s targets in the lurch — unable to pay the ransom to get their data back and their businesses back up and running.

“What’s the plan for the victims?” asked Kurtis Minder, the chief executive of Groupsense, a digital risk protection company that was negotiating with the extortionists on behalf of a regional law firm whose data was stolen.

There were three main theories floating around about why REvil, which seemed to revel in the publicity and reaped huge ransoms — including $11 million from JBS — suddenly disappeared.

One is that Mr. Biden ordered the United States Cyber Command, working with domestic law enforcement agencies, including the F.B.I., to bring the group’s sites down. Cyber Command proved last year that it could do just that, paralyzing a ransomware group that it feared might turn its skills to freezing up voter registrations or other election data in the 2020 election.

The second theory is that Mr. Putin ordered the group’s sites taken down. If so, that would be a gesture toward heeding Mr. Biden’s warning, which he offered, in more general terms, when the two leaders met on June 16 in Geneva.

And a third is that REvil decided that the heat was too intense, and took the sites down itself to avoid becoming caught in the crossfire between the American and Russian presidents. That is what another Russian-based group, Darkside, did after the ransomware attack on Colonial Pipeline, the U.S. company that had to shut down the gasoline and jet fuel running up the East Coast in May.

But many experts think that Darkside’s going-out-of-business move was digital theater, and that all of the key ransomware talent would reassemble under a different name. If so, the same could happen with REvil.

Just a few months ago, ransomware was considered largely a criminal problem. But after the attack on Colonial Pipeline, Mr. Biden and his advisers began to declare that attacks that threaten critical infrastructure constitute a major national security threat.

Source Link



Africa,973,Americas,4395,Art & Culture,16280,Arts,6830,Arts & Design,1939,Asia,3622,Automobile,586,Baseball,857,Basketball,701,Books,4252,Business,5737,Celebrity,2631,Cricket,648,Crime,158,Cryptocurrency,2266,Dance,735,Defense,836,Diplomatic Relations,2496,Economy,1419,Editorial,260,Education,1532,Elections,308,Energy & Environment,3213,Entertainment,23743,Environment,4004,Europe,4589,Faith & Religion,234,Family & Life,817,Fashion & Style,3703,Finance,22157,Food & Drink,4180,Football,1326,Games,97,Gossip,10283,Health & Fitness,4530,Health Care,979,Hockey,288,Home & Garden,917,Humour,994,Latin America,49,Lifestyle,18703,Media,527,Middle East,1777,Movies,2068,Music,3008,Opinion,4230,Other,13376,Other Sports,5515,Political News,11322,Political Protests,2324,Politics,18948,Real Estate,2376,Relationship,106,Retail,3115,Science,3000,Science & Tech,11299,Soccer,395,Space & Cosmos,467,Sponsored,4,Sports,13726,Technology,3828,Tennis,751,Theater,1994,Transportation,313,Travel,2880,TV,4034,US,1646,US Sports,1481,Video News,3531,War & Conflict,1069,Weird News,996,World,18367,
Newsrust - US Top News: REvil, Hacking Group Behind Major Ransomware Attack, Disappears
REvil, Hacking Group Behind Major Ransomware Attack, Disappears
Newsrust - US Top News
Loaded All Posts Not found any posts VIEW ALL Readmore Reply Cancel reply Delete By Home PAGES POSTS View All RECOMMENDED FOR YOU LABEL ARCHIVE SEARCH ALL POSTS Not found any post match with your request Back Home Sunday Monday Tuesday Wednesday Thursday Friday Saturday Sun Mon Tue Wed Thu Fri Sat January February March April May June July August September October November December Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec just now 1 minute ago $$1$$ minutes ago 1 hour ago $$1$$ hours ago Yesterday $$1$$ days ago $$1$$ weeks ago more than 5 weeks ago Followers Follow THIS PREMIUM CONTENT IS LOCKED STEP 1: Share to a social network STEP 2: Click the link on your social network Copy All Code Select All Code All codes were copied to your clipboard Can not copy the codes / texts, please press [CTRL]+[C] (or CMD+C with Mac) to copy Table of Content