Sources: ransomware gang REvil was hacked and forced offline this week by an active multi-country operation that includes US law enforcement
The ransomware group REvil was itself hacked and forced offline this week by a multi-country operation, according to three private sector cyber experts working …
Reuters
Context & Ripple Effects
REvil had already shown how a compromise of Kaseya's IT management software could spread ransomware through managed service providers, then disappeared from its public infrastructure in July before its infrastructure later became accessible again. The latest disruption follows reports that the FBI delayed releasing a decryptor while pursuing a separate operation against REvil.
The action also lands shortly after Ukrainian arrests of alleged ransomware members, made with U.S. and French assistance, tying the case to a broader cross-border enforcement effort rather than a one-off infrastructure outage.
First-order effects
REvil loses access to the infrastructure and public-facing sites needed to run ransomware operations and pressure victims through data-leak channels.
U.S. and partner law-enforcement agencies gain an operational disruption to pair with the recent arrests in Ukraine of suspected ransomware participants.
Second-order effects
Other ransomware operators must account for the prospect that infrastructure can be seized or compromised through coordinated international action, not merely blocked by victims or security vendors.
Organizations affected by REvil gain a temporary reduction in exposure to new REvil-led extortion activity, while defenders can focus on remediation rather than an active campaign from the group.
Third-order effects
The case points toward ransomware enforcement combining arrests, intelligence-led infrastructure disruption, and victim-response tools across jurisdictions instead of relying on any single intervention.
If such operations become repeatable, ransomware groups' ability to operate durable public leak and payment infrastructure will become a more central constraint on their business model.
The trend: Ransomware defense is shifting toward coordinated international disruption of criminal infrastructure alongside incident response and arrests.
“law enforcement and intelligence cyber specialists were able to hack REvil's..infrastructure, obtaining control of...some of their servers....When [REvil] restored...websites from a backup last month [they] unknowingly restarted...systems...already controlled by law enforcement”…
#MUSTREAD: Declaration of ransomware as national security issue unlocked US intelligence and military assets to bring down Colonial Pipeline hacker infrastructure, infecting their backups and driving leader underground | @Bing_Chris + @josephmenn | https://www.reuters.com/...
Inevitable outcome and indeed the price of playing the game. They were loose and fast with victims and sloppy at that. The moment you hit a connected firm, it was only a matter of time before you got hit much harder. https://twitter.com/...
“Before, you couldn't hack into these forums, and the military didn't want to have anything to do with it. Since then, the gloves have come off.” https://twitter.com/... https://twitter.com/...
I honestly hope this is true. If it is, it shouldn't be leaked out from people tangential to the operation, but should be announced officially by US gov sources. https://twitter.com/...
“When gang member 0_neday and others restored those websites from a backup last month, he unknowingly restarted some internal systems that were already controlled by law enforcement.” Incident Response is tough af sometimes. https://twitter.com/...
Wow. Four people familiar say the REvil ransomware group was knocked offline earlier this week by a multi-nation law enforcement effort. One of the hackers “unknowingly restarted some internal systems that were already controlled by law enforcement.” https://www.reuters.com/... h…