The Russian Revil ransomware, behind some of the biggest recent cyberattacks, has disappeared from the Internet. As reported by CNBC, Reuters and The Washington Post, BleepingComputer, SecurityAffairs and Engadget, the sites run by the gang were taken down in the early hours of July 13.
Dmitri Alperovitch, former chief technology officer of cybersecurity firm CrowdStrike , told The Post that the gang’s dark web blog is still accessible . However, the main sites that victims use to negotiate with the gang and obtain decryption tools (if they pay the required ransom) are no longer available . Those visiting those sites now see a message that says “The server with the specified hostname could not be found . ”
Read also: REVIL ransomware: New Linux cryptor targets ESXi VMs
The REvil gang has claimed responsibility for a series of recent ransomware attacks that affected about 1,500 businesses around the world, including schools. The hackers demanded a ransom of $70 million to restore the data they stole and encrypted. Before that, experts linked the gang to cyberattacks suffered by Colonial Pipeline, Kaseya , and JBS (which chose to pay $11 million to recover its data).
See also: Interpol: Calls on police forces to unite against the potential "ransomware pandemic"
It is not yet clear why the REvil gang's sites are no longer accessible. According to Reuters, ransomware gangs tend to disappear and reappear under a different name when they attract too much attention. US President Joe Biden recently revealed that he told Russian President Vladimir Putin that he expects his government to take action on ransomware attacks originating in his country. When asked if the US would attack servers used by Russian hackers to compromise American networks, Biden answered with a resounding "Yes".
Proposal: Ransom tracker shows how much Bitcoin ransomware groups have received
Alperovitch told The Post that there appears to be no attack on the REvil gang’s servers, suggesting that it is unlikely that the U.S. government carried out a cyberattack. Kurtis Minder, founder of threat intelligence firm GroupSense, told Reuters that if the gang’s sites were indeed taken down as a result of a U.S. government offensive, he hopes “collateral damage will be addressed.” The hackers hold the key to the data they are ransoming, and victims will have a hard time recovering their own data if the key is destroyed or lost.
