The Russia-based criminal syndicate behind a devastating series of recent ransomware attacks was offline on Tuesday, but cybersecurity experts said that it was premature to speculate why and that there was no indication of a law enforcement takedown.
REvil’s dark web data-leak site and ransom-negotiating portals were both unreachable, cybersecurity researchers said. The group was responsible for the Memorial Day ransomware attack on the meat processor JBS and the supply-chain attack this month targeting the software company Kaseya that crippled well over 1,000 businesses globally.
President Joe Biden told Russian President Vladimir Putin on a call Friday that he needed to rein in attacks from Russia-based groups and warned that the U.S. had the right to defend its people and critical infrastructure from attacks.
But there were no immediate or public signs that the government had anything to do with REvil appearing offline. It was also possible that the group was laying low after the attack, or switching methods “as we did expose them," said threat researcher Ryan Sherstobitoff of SecurityScorecard.
“It could be that the server hardware failed, or that it was intentionally taken down, or that someone attacked their host,” said Sean Gallagher a threat researcher at the cybersecurity firm Sophos. He noted that REvil’s public ransom-negotiating site was also down last week.
Spokespeople for the White House and U.S. CyberCommand, the Pentagon's cyber arm, declined to comment on Tuesday.
“We have seen no indicators for either voluntary shutdown nor of any offensive steps from law enforcement," said Alex Holden, founder and chief information security officer of Hold Security. “Right now, perhaps, it is too early to speculate, especially as REvil was building up their strength over the recent months.”
"There is always a glimmer of hope that Russia is finally doing something right,” he added.
Ransomware variants have previously disappeared as the criminals behind them retooled and modified their malware before introducing it under a new guise. That’s what threat analysts believe happened with a precursor to the REvil ransomware-as-a-service software called Gandcrab. It was the most successful variant over a 15-month run that began in January 2018.
