A US/Foreign Government Operation Hijacked the Servers of a Major Ransomware Gang (msn.com) 24
The U.S. Department of Defense's internet-defending Cyber Command teamed with "a foreign government" in two operations which shut down a major overseas ransomware group by hijacking its servers, reports the Washington Post. Several U.S. officials told the Post the operation left the ransomware gang's leaders "too frightened of identification and arrest to stay in business."
"Domains hijacked from REvil," wrote 0_neday, an REvil leader, on a Russian-language forum popular with cyber criminals, on October 17.... "The server was compromised," he wrote hours later, "and they are looking for me." And then: "Good luck everyone, I'm taking off."
Soon after, REvil ceased operations, such as recruitment of affiliates, ransom negotiations and distribution of malware.
The Washington Post previously reported that REvil's servers ["reachable only through Tor"] had been hacked in the summer, permitting the FBI to have access. The compromise allowed the FBI, working with the foreign partner, to gain access to the servers and private keys, officials said. The bureau was then able to share that information last month with the U.S. Cyber Command, enabling the hijacking, they said... Cyber Command leader, General Paul Nakasone, said at the Aspen Security Forum on Wednesday that while he wouldn't comment on specific operations, "we bring our best people together ... the really good thinkers" to brainstorm ways to "get after folks" conducting ransomware attacks and other malign activities. "I'm pleased with the progress we've made," he said, "and we've got a lot more to do."
The group's departure may be temporary. Ransomware gangs have been known to go underground, regroup and reappear, sometimes under a new name. But the recent development suggests that ransomware crews can be influenced — even temporarily — to cease operations if they fear they will be outed and arrested, analysts say. "The latest voluntary disappearance of REvil highlights the powerful psychological impact of having these villains believe that they are being hunted and that their identities will be revealed," said Dmitri Alperovitch, executive chairman of the think tank Silverado Policy Accelerator and a cyber expert. "U.S. and allied governments should proudly acknowledge these cyber operations and make it clear that no ransomware criminal will be safe from the long reach of their militaries and law enforcement agencies...."
Recorded Future threat intelligence analyst Dmitry Smilyanets believes "REvil as a brand is done."
And meanwhile, an anonymous Slashdot reader shares the news that German investigators "have identified a deep-pocketed, big-spending Russian billionaire whom they suspect of being a core member of the REvil ransomware gang," according to Threatpost. "He lolls around on yachts, wears a luxury watch with a Bitcoin address engraved on its dial, and is suspected of buying it all with money he made as a core member of the REvil ransomware gang." The showy billionaire goes by "Nikolay K." on social media, and German police are hoping he'll cruise out of Russia on his next vacation — preferably, to a country with a cooperation agreement with Germany so they can arrest him. In case he decides to kick back somewhere other than sunny Crimea, they've got an arrest warrant waiting for him....
According to Reuters, which broke the news about last week's law enforcement move against the gang, REvil's also behind the Colonial Pipeline attack, as opposed to a culprit presumed to be a ransomware group named DarkSide.
Soon after, REvil ceased operations, such as recruitment of affiliates, ransom negotiations and distribution of malware.
The Washington Post previously reported that REvil's servers ["reachable only through Tor"] had been hacked in the summer, permitting the FBI to have access. The compromise allowed the FBI, working with the foreign partner, to gain access to the servers and private keys, officials said. The bureau was then able to share that information last month with the U.S. Cyber Command, enabling the hijacking, they said... Cyber Command leader, General Paul Nakasone, said at the Aspen Security Forum on Wednesday that while he wouldn't comment on specific operations, "we bring our best people together ... the really good thinkers" to brainstorm ways to "get after folks" conducting ransomware attacks and other malign activities. "I'm pleased with the progress we've made," he said, "and we've got a lot more to do."
The group's departure may be temporary. Ransomware gangs have been known to go underground, regroup and reappear, sometimes under a new name. But the recent development suggests that ransomware crews can be influenced — even temporarily — to cease operations if they fear they will be outed and arrested, analysts say. "The latest voluntary disappearance of REvil highlights the powerful psychological impact of having these villains believe that they are being hunted and that their identities will be revealed," said Dmitri Alperovitch, executive chairman of the think tank Silverado Policy Accelerator and a cyber expert. "U.S. and allied governments should proudly acknowledge these cyber operations and make it clear that no ransomware criminal will be safe from the long reach of their militaries and law enforcement agencies...."
Recorded Future threat intelligence analyst Dmitry Smilyanets believes "REvil as a brand is done."
And meanwhile, an anonymous Slashdot reader shares the news that German investigators "have identified a deep-pocketed, big-spending Russian billionaire whom they suspect of being a core member of the REvil ransomware gang," according to Threatpost. "He lolls around on yachts, wears a luxury watch with a Bitcoin address engraved on its dial, and is suspected of buying it all with money he made as a core member of the REvil ransomware gang." The showy billionaire goes by "Nikolay K." on social media, and German police are hoping he'll cruise out of Russia on his next vacation — preferably, to a country with a cooperation agreement with Germany so they can arrest him. In case he decides to kick back somewhere other than sunny Crimea, they've got an arrest warrant waiting for him....
According to Reuters, which broke the news about last week's law enforcement move against the gang, REvil's also behind the Colonial Pipeline attack, as opposed to a culprit presumed to be a ransomware group named DarkSide.
Simple tools. (Score:2)
Apparently their software development was too complex. ;-)
Re: (Score:2)
It's in the pudding, numbnuts.
Cyber Command... (Score:2)
Sounds like one of those 90s kids' shows that were trying to jump on the Power Rangers popularity bandwagon.
And Now The Story Grows Legs (Score:3)
Now the story grows legs, starts spreading wider and wider, all the while going further in to lore and legend.
MSN reporting n a Washington Post story that may well have started on Twitter. No facts. No revelations. Just more and more speculation and hyperbole with every retelling.
The only things we know for sure are that Cyber Command has alluded to being responsible for REvil perpetrators perhaps going into hiding. No one knows who they are where they were or where they went.
Re: (Score:2)
You mean you didn't get the secret memos detailing the insides of the operation? This is an outrage. I encourage you to go right to the top, tell the world of your special insight.
It happened: NOT news. The US admits it - news (Score:1)
If the reporting is reliable - and some earlier posters have called it into question - then it IS news that the US Government is owning up to this.
What's NOT news is that the US government is infiltrating and taking down those who seek to harm the United States and its citizens and companies based in it.
US-government espionage and counter-espionage - whether against governments or against private actors - has presumably been happening for as long as the US government has existed.
It's safe to assume the same
Waiting for the retaliation (Score:3)
The next level of escalation, I believe, will be when these cybercrime organizations, many of which are state-funded by countries like Russia, China, and North Korea, decide they've had enough and start counter-attacking.
Expect critical infrastructure and financial institutions to be attacked, and not for 'ransom', but purely to cause damage.
See, I believe they already have the capability to wreck entire nations, but haven't done so up to this point purely to 'not kill the goose that lays golden eggs'. But if countries are bringing the fight to them? Then perhaps that's off the table now.
Guess we'll see. All depends on how thorough various law enforcement is in taking them down.
Re: Waiting for the retaliation (Score:2)
Re: (Score:2)
Re: Waiting for the retaliation (Score:2)
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
I think you underestimate the fear value of being on a targeted assassination list. Suddenly, using any electronic device makes you wonder if its essentially a homing signal. Which of your associates have decided to turn on you in exchange for a payoff? Maybe your current benefactor is worried you'll talk, and they're now after you....hey, maybe cooperating with the CIA and getting out in front of this thing is a better option..
A lot of the benefit of a kill list for an agency like the CIA isn't necessar
Serious? (Score:2)
You really needed an analyst to figure this one out?
Hack back. (Score:2)
Forget waiting for him to go on vacation just hack one of his yachts and have it drive him out into international waters. You might need someone to plug in a USB stick or something but I doubt yachts have high-end secure software, even if they claim that they do.
Great (Score:2)
"The server was compromised," he wrote hours later, "and they are looking for me." And then: "Good luck everyone, I'm taking off."
Ha ha, you're dead meat, you piece of shit.
I bet they catch him...in the current environment you have to be really, really good not to leave any viable leads or trails or traces.
Someone in their group was probably just a little sloppy or maybe not paranoid enough, and left a trail that'll be their undoing.
Even taking steps to conceal your origin or identity leaves a record. True
Re: (Score:3)
One of the guys from the original team tried to set up again using poisoned backups from when the Feds last took them out.
Rooky mistake.
SecOps 101, don't trust the data on servers you know have been compromised.
Re: (Score:2)
Worse, poisoned backups is a strategy REvil themselves used against their victims.
Reverse card (Score:3)
How much is the Cyber Command demanding to give the servers back to Revil?
With the bounties on the ransomware groups (Score:1)
With the bounties on the ransomware groups offered by US government and others, how long before someone in Russia offers to "disappear" the wanted people for the bounty?
https://www.dw.com/en/us-issue... [dw.com]
Since they are supposedly based in Russia, and some of them have been supposedly identified, will not be surprised if someone offers.