Russia's FSB says it detained and charged REvil ransomware gang members at the request of the US; source: Russian citizens won't be handed over to the US
Russia's FSB security service conducted a special operation against ransomware crime group REvil at the request of the United States …
Reuters Gabrielle Tétrault-Farber
Context & Ripple Effects
The detentions follow a broader campaign against REvil: a U.S. operation that held back a decryptor and a reported multi-country operation that forced the group offline had already targeted its operations. Europol had also announced arrests in Ukraine of suspects some believed were linked to REvil.
Russia is now acting on a U.S. request, but the stated refusal to transfer Russian citizens preserves a domestic Russian legal channel rather than a U.S. prosecution. Later coverage reports that four convicted REvil members were released, underscoring the importance of what domestic custody ultimately delivers.
First-order effects
- The FSB takes alleged REvil members into Russian custody and brings charges after a U.S. request, interrupting the group’s personnel base in Russia.
- U.S. authorities gain Russian enforcement action against a ransomware group, while the reported non-extradition stance keeps the suspects outside the U.S. court system.
Second-order effects
- The action extends the pressure created by the operation that pushed REvil offline, combining technical disruption and arrests across multiple jurisdictions rather than relying on any single country’s enforcement.
- Victims and businesses affected by REvil face a more fragmented path to accountability: Russian proceedings may constrain operators, but they do not place the defendants under U.S. jurisdiction.
Third-order effects
- If this enforcement pattern holds, cross-border ransomware cases will increasingly depend on states prosecuting nationals at home, with operational cooperation possible even where extradition is unavailable.
- The REvil campaign points toward ecosystem cyber defense built from coordinated arrests, technical takedowns, and intelligence sharing rather than a single decisive prosecution.
The trend: Ransomware enforcement is becoming a multi-jurisdiction campaign that pairs technical disruption with domestic prosecutions when extradition is politically unavailable.
Related: Ecosystem cyber defense · REvil · Reported multi-country operation forced REvil offline · Europol arrests alleged REvil-linked suspects in Ukraine · Russia releases four convicted REvil members
Related Coverage
- View article The White House
- Russia arrests 14 alleged members of REvil ransomware gang, including hacker U.S. says conducted Colonial Pipeline attack Washington Post
- Russia Takes Down REvil Hackers—as Ukraine Tensions Mount Wired
- FSB arrests REvil ransomware gang members The Record
- Russia's FSB ‘shuts down’ notorious REvil ransomware gang TechCrunch
- Russia Detains REvil Ransomware Hackers at the Request of U.S. Bloomberg
- МВД проси т арест овать дв … ТАСС
- Russian government arrests REvil ransomware gang members BleepingComputer
- Russia Takes Down REvil Ransomware Operation, Arrests Key Members Dark Reading
- MacBook Pro design hackers REvil all arrested, say Russian authorities 9to5Mac
- REvil ransomware crew allegedly busted in Russia, says FSB Naked Security
- Russia Arrests Hackers Tied to Major U.S. Ransomware Attacks, Including Colonial Pipeline Disruption Wall Street Journal
- Russia shuts down REvil ransomware group as Ukraine tensions grow New York Post
- Russia Arrests REvil Ransomware Gang Responsible for High-Profile Cyber Attacks The Hacker News
- Russian authorities raid REvil hackers, seize luxury cars and crypto The Block
- One of the REvil members arrested by FSB was behind Colonial Pipeline attack Security Affairs
- . REvil Инт …
- Следс твие попро сило суд … rbc.ru
- View article scmagazine.com
- Ransomware Group REvil Dismantled in Raids, Russia Says New York Times
- White House confirms person behind Colonial Pipeline ransomware attack nabbed during Russian REvil raid ZDNet
- At Request of U.S., Russia Rounds Up 14 REvil Ransomware Affiliates Security Boulevard
- Russia's FSB announces sting against members of REvil cybercrime gang CyberScoop
- Russia arrests REvil ransomware gang members at request of US officials TechRepublic
- Russia says it has shut down notorious REvil ransomware group TechSpot
- REvil, the group behind MacBook Pro design leaks, is arrested by Russian authorities iThinkDifferent
- Russian government claims to have dismantled REvil ransomware gang Security Affairs
- Russia arrests ransomware gang responsible for high-profile cyberattacks NBC News
- Russia says it has neutralized the cutthroat REvil ransomware gang Ars Technica
- REvil Ransomware Hackers Arrested By Russian Authorities CRN
- По25 адрес ам были изъят ы св … YouTube
- REvil ransomware gang arrested in Russia BBC
- Russia Arrests Members of REvil, One of the World's Most Wanted Ransomware Gangs Gizmodo
- View article WinBuzzer
- Feds want businesses to report cyberattacks — the agency doesn't matter Cybersecurity Dive
- Gang that stole MacBook Pro blueprints completely shut down by Russian law enforcement AppleInsider
- Russia says it has dismantled the REvil ransomware gang TechRadar
- Russian intelligence service arrests members of Ransomware gang REvil NBC News
- Russia's FSB says it has taken down REvil hacker group at US request The Verge
- Russia Arrests Members of REvil Ransomware Group, Citing US Request PCMag
- Hackers Behind MacBook Pro Schematics Leak Arrested in Russia MacRumors
- Russian Authorities Claim All Members of MacBook Hacker Group REvil Arrested iPhone Hacks
- Russian Security Takes Down REvil Ransomware Gang Threatpost
- Russia Says It Arrested Members of Notorious ‘REvil’ Ransomware Gang VICE
Discussion
-
@mike_eckel
Mike Eckel
on x
FSB video of the alleged raid (which is entertaining but not that enlightening): https://twitter.com/...
-
@wired
@wired
on x
In an unprecedented move that's likely to send ripples through the inner circles of other Russia-based cybercriminal gangs, the country's security agency has arrested 14 alleged members of REvil. https://www.wired.com/...
-
@jenniferjjacobs
Jennifer Jacobs
on x
Russia's arrests of several members of the notorious REvil ransomware gang at request of US law enforcement mark a rare example of cooperation at a time when tensions are high over a mass buildup of Russian troops near Ukraine. https://www.bloomberg.com/...
-
@sonicwall
@sonicwall
on x
Suspected members of the #REvil #ransomware gang have been detained and the group has been dismantled following raids by Russia's Federal Security Service (FSB). via @ZDNet https://www.zdnet.com/...
-
@wiredscience
@wiredscience
on x
Over a dozen alleged members of the notorious ransomware group have been arrested, but the Kremlin's critics are wary of the underlying motivation. https://www.wired.com/...
-
@zacharybasu
Zach Basu
on x
Breaking: A senior U.S. official confirms that Russia has arrested alleged members of the REvil ransomware gang, including an individual responsible for the cyberattack that crippled the Colonial Pipeline. https://www.axios.com/...
-
@starsandstripes
@starsandstripes
on x
The move is welcome, but analysts said it seems aimed to send a signal that such cooperation would cease if the United States and Western allies impose sanctions in the event of a Russian invasion of Ukraine. https://www.stripes.com/...
-
@lilyhnewman
Lily Hay Newman
on x
“The big question, I suppose, is does this represent a real shift in Russia's intentions to deal with this problem, or has REvil simply been sacrificed in an attempt to alleviate some international pressure?” @BrettCallow https://www.wired.com/...
-
@campuscodi
Catalin Cimpanu
on x
A second REvil member was also identified by TASS. His name is Andrei Bessonov. (h/t @EErchov) https://tass.ru/...
-
@kimzetter
Kim Zetter
on x
“The [REvil takedown] is welcome, but analysts said it seems aimed to send a signal that such cooperation would cease if the United States and Western allies impose sanctions in the event of a Russian invasion of Ukraine.” https://www.washingtonpost.com/ ...
-
@appleinsider
@appleinsider
on x
The Russian government says it has dismantled and detained criminal ransomware group REvil, which extorted Apple and launched high-profile ransomware campaigns, at the request of the United States. https://appleinsider.com/... https://twitter.com/...
-
@nakashimae
Ellen Nakashima
on x
This individual was involved in the Colonial Pipeline incident, a U.S. official tells me. Although Colonial was claimed by DarkSide, it is quite possible that the hacker shown worked for both REvil and DarkSide, @uuallan says. https://twitter.com/...
-
@lorenzofb
Lorenzo Franceschi-Bicchierai
on x
NEW: Russia's FSB says it has arrested 14 alleged members of the “REvil” ransomware gang in response to a US government request. REvil is the gang behind the hacks on Colonial Pipeline, JBS, and Kaseya. https://www.vice.com/...
-
@jamiemaccoll
Jamie MacColl
on x
The FSB has arrested 14 members of the REvil ransomware group. This is going to test a lot of assumptions about how the Russian state deals with cybercriminals within its borders. https://therecord.media/...
-
@ericgeller
Eric Geller
on x
Russia's FSB says it has arrested members of the REvil ransomware gang (best known for the JBS and Kaseya hacks) and shut down the group's infrastructure: https://www.fsb.ru/... But Russia reportedly won't turn over the Russians among them to the U.S.: https://www.reuters.com/...
-
@malwarejake
Jake Williams
on x
Anyone thinking this isn't significant because Russian citizens won't be handed over to US authorities is missing a bigger picture: diplomatic pressure is working. This operation would have been unthinkable a year ago. https://twitter.com/...
-
@campuscodi
Catalin Cimpanu
on x
Below is a video of the FSB's REvil raids https://twitter.com/...
-
@campuscodi
Catalin Cimpanu
on x
Raids were conducted today at 25 residents owned by 14 members suspected to be part of the REvil team across Moscow, St. Petersburg, Leningrad, and the Lipetsk regions. https://therecord.media/...
-
@gcluley
Graham Cluley
on x
At the request of USA, Russia's FSB say they have seized money and resoures, and arrested 14 members of the REvil ransomare gang. https://www.interfax.ru/... https://twitter.com/...
-
@campuscodi
Catalin Cimpanu
on x
Breaking: The FSB has raided members of REvil ransomware gang https://therecord.media/... https://twitter.com/...