REvil's infrastructure and websites are offline, including its data leak sites, less than two weeks after attacking 1,500+ businesses with ransomware via Kaseya
The infrastructure and websites for the REvil ransomware operation have mysteriously gone offline as of last night.
Context & Ripple Effects
Ten days after [[a:968111|REvil pushed ransomware through a compromised Kaseya software update to hundreds of managed service providers]], the gang's public-facing infrastructure — including its data leak sites — has gone dark. The disappearance came shortly after the gang used its dark web blog to claim over one million infected systems and post a $70M bitcoin demand for a universal decryptor.
The outage matters because it severs the extortion channel mid-campaign: victims negotiating or monitoring leak threats no longer have a live counterparty. Subsequent reporting fills in the arc — CrowdStrike later observed REvil's site accessible again on the dark web, and by October sources told Reuters an active multi-country law enforcement operation had hacked the gang and forced it offline.
First-order effects
- Victims and negotiators of the Kaseya attack lose their primary pressure-and-payment interface overnight, since leak sites are where REvil names non-payers and hosts stolen data.
Second-order effects
- Kaseya's own recovery track — obtaining a universal decryptor and requiring NDAs from affected customers before handing it over — proceeds independently of whether REvil's sites are up, decoupling victim remediation from the gang's operations.
Third-order effects
- If coordinated multi-country operations become the standard response to headline ransomware campaigns, gangs face structural pressure toward resilient, decentralized infrastructure rather than single-hosted blogs and payment portals — a shift already hinted at when the sites reappeared after this outage.
The trend: Governments are shifting from defensive incident response to actively dismantling ransomware operations' infrastructure, with each high-profile campaign triggering a law enforcement counterstrike.