REvil Takedown: Temporary or Permanent?

REvil Takedown: Temporary or Permanent?

On January 14, 2022, Russia’s Federal Security Service (FSB) announced that it had arrested several alleged members of the REvil ransomware group. Although several affiliates were arrested in 2021 globally, this event is notable in that it marks the first time that Russia has publicly cooperated with a request to take action against ransomware operators within its borders. The actions taken against REvil come after a period of inactivity by the group caused by an unidentified third party gaining control of its Tor onion domain in October. ZeroFox does not expect the arrests by the FSB to have a lasting impact on the activities of the threat actors behind REvil or to suppress the broader ransomware threat in the long term.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

• Ensure antivirus and intrusion detection software is up to date with all patches and rule sets.
• Enable two-factor authentication for all organizational accounts to help mitigate phishing and credential stuffing attacks.
• Maintain regularly scheduled backup routines, including off-site storage and integrity checks.
• Avoid opening unsolicited attachments and never click suspicious links.
• Log and monitor all administrative actions as much as possible. Alert on any suspicious activity.
• Review network logs for potential signs of compromise and data egress.
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance.
• If one of the relevant entities receives an alert, ZeroFox Intel Research and Analysis recommends immediate password changes for the affected account.

What Happened?

On January 14, 2022, Russia’s FSB announced that it had arrested several alleged members of the REvil ransomware group – also known as Sodinokibi – after raids covering 25 locations and 14 individuals. In the announcement, the FSB also stated that the search was conducted after an appeal by U.S. authorities.¹ ZeroFox has reported on more than 150 victims of REvil between January and October 2021, including large-scale attacks on JBS Foods and Kaseya. Out of the 14 people arrested, eight names were made public:

• Bessonov, Andrey
• Golovachuk, Mikhail A.
• Khansvyarov, Ruslan A.
• Korotayev, Dmitry V.
• Malozemov, Alexei V.
• Muromsky, Roman
• Puzyrevsky, D.D.
• Zayets, Artem N.

Each of the suspects has been jailed for two months and is under investigation for “Illegal Circulation of Payments” which could result in up to eight years in prison and up to one million rubles (roughly USD 13,000) in fines. Although only 14 alleged members have been arrested, FSB claims to have identified the entire REvil group. The raids followed multiple requests by the United States for the Kremlin to help shut down such groups. These latest arrests come on the heels of a worldwide crackdown on ransomware groups in 2021, including Europol reportedly arresting seven affiliates between February and November and the U.S. arrest of one affiliate and the indictment of another.^{2 3}

What Does This Mean?

Although these arrests may be detrimental or even fatal to the REvil brand, ZeroFox does not expect them to have a lasting impact on the activities of the threat actors behind the operation or to suppress the broader ransomware threat in the long term. These individuals’ roles within REvil’s collective have not yet been disclosed, though it is unlikely they are core members. REvil’s malicious activity dropped in Q4 2021, likely in part due to growing retaliatory action by U.S. authorities.⁴ ZeroFox assesses that this latest disruption will likely drive core members to rebrand their operation before restarting malicious activities.

As Russia has repeatedly ignored calls to take action against ransomware operators based within its borders,⁵ the timing of the disruption indicates ulterior political motives rather than the start of a true Russian law enforcement campaign against domestic cyber threat actors. Specifically, these arrests were announced on the same day that the U.S. accused Russia of sending saboteurs into Ukraine to create a pretext for invasion, and hackers shut down dozens of Ukrainian government websites — an attack alleged by Kyiv to have originated in Russia.⁶ Russia may seek to leverage disruptive activity for diplomatic purposes, particularly amidst escalating tensions on the border with Ukraine and threats of sanctions against Russia.⁷

Is This the End of REvil?

ZeroFox assesses that, although the arrests of any affiliate or operator of a ransomware group within Russia sends a message, it is unlikely that the recent efforts against REvil will be the end of the group, as the arrested individuals are not believed to be “core” members that operated this ransomware-as-a-service (RaaS).⁸ It is also not uncommon for affiliates or members of ransom groups to operate within multiple groups at once. If the remaining members do not continue operations as REvil or rebrand—as they have previously done after operating as Gandcrab⁹— they may continue to conduct attacks through other new or existing groups.

In September 2021, shortly after the group returned from a brief hiatus, a forum user by the name of “lo0o0o0ong” accused REvil of creating a backdoor in its ransomware. With the way REvil performed file encryption, the group’s operators could recover victims’ encrypted files without the assistance of their affiliates. This opened the door to REvil potentially bypassing the affiliate and taking the full ransom payment for themselves. In later posts, LockBit representative “LockBitSupp” also seemed to confirm that REvil had been scamming affiliates in this manner.

Figure 1. LockBit representative LockBitSupp seemingly confirming complaints of REvil taking over ransom negotiations and payments
Source: ZeroFox Research

In October 2021, a member of REvil posted on underground forums that an unknown third party had compromised the private key for their Tor hidden service after the disappearance of one of their members. After this incident, the group stopped all public ransom activity. ZeroFox has not seen any activity from REvil since October 4, 2021.

Figure 2. Actor 0_neday announcing that a third party obtained the private key to REvil’s Tor hidden service
Source: ZeroFox Research

1: hXXp://www[.]fsb[.]ru/fsb/press/message/single.htm%21id%3D10439388%40fsbMessage.html
2: hXXps://www[.]europol.europa.eu/media-press/newsroom/news/five-affiliates-to-sodinokibi/revil-unplugged
3: hXXps://krebsonsecurity[.]com/2021/11/revil-ransom-arrest-6m-seizure-and-10m-reward/
4: hXXps://www[.]independent.co.uk/news/world/americas/us-politics/revil-ransomware-attacks-russia-hack-b1953821.html
5: ​​hXXps://www[.]reuters[.]com/technology/ biden-pressed-putin-call-act-ransomware-attacks-white-house-2021-07-09/
6: hXXps://www[.]nytimes[.]com/2022/01/14/us/politics/russia-ukraine-us-intelligence.html
7: hXXps://www[.]nytimes[.]com/2022/01/08/us/politics/us-sanctions-russia-ukraine.html
8: hXXps://twitter[.]com/y_advintel/status/1482376988933464071
9: hXXps://www[.]darkreading[.]com/attacks-breaches/ gandcrab-devlopers-behind-destructive-revil-ransomware