Ransomware Threat Actor REvil Websites Go Offline
In the early hours of June 13 all the websites operated by REvil - one of the biggest active ransomware threat actors - went offline. There is no hard information regarding the cause of the blackout.
At this point in time, anyone following cybersecurity news probably knows who REvil are. The ransomware gang was behind the recent $11 million ransomware attack on JBS - America's biggest fresh meat supplier, as well as the more recent supply chain attack on Kaseya.
On Tuesday, June 13, all websites operated and associated with REvil, both on the dark web and those accessible normally, went offline. In their report on the incident, Threatpost highlights that this does not necessarily mean REvil's infrastructure has been taken apart by law enforcement, it simply means the websites were not accessible, "at least" until the afternoon on the same day.
It is very easy to speculate that REvil going dark for a while has something to do with the phone call president Joe Biden and Russian president Vladimir Putin had just a few days ago, in which Biden attempted to pressure Putin to take decisive action against ransomware gangs operating out of Russian territories. Biden was very firm in his stance and when asked by journalists whether the US is ready to take action against the infrastructure used by ransomware groups based in Russia, his answer was short and affirmative.
Threatpost quoted cybersecurity expert Jake Williams, acting CTO of BreachQuest, saying that regardless of the reasons behind the REvil websites going offline, ransomware threat actors operating out of Russia were "on borrowed time" from the moment DarkSide group pulled off the hack on Colonial Pipeline in early May 2021.
Theories about what really happened to REvil's websites are many and span from the involvement of law enforcement agencies to REvil simply trying to rebrand and restructure, to REvil simply being too scared and lying low, at least momentarily.
It would be overly optimistic to hope that REvil has been done away with once and for all, especially in the absence of any official announcements concerning the involvement of any state authorities. Whether REvil comes back swinging after this or has really been hit by a government takedown remains to be seen.
