Multi-nation operation hacks into ransomware group REvil

Several countries joined hands to target REvil, a ransomware group, and forced it to go offline a few days back.

News agency Reuters quoted three cyber experts to claim that the Russian group’s “Happy Blog” website, which had been used to leak victim data and extort companies, is no longer available.

The Russian group’s cyberattack on US firm, Colonial Pipeline, in May this year crippled gas supplies to the East Coast of USA. The group then targeted another US firm, Kaseya, in July. This acted as an immediate trigger to launch a counterattack on REvil.

Reuters quoted VMWare head of cybersecurity strategy Tom Kellermann to say that the ransomware group has been stopped from victimizing more companies like JBS.

Kellermann, who is also an adviser to the U.S. Secret Service on cybercrime, said the FBI collaborated with secret service Cyber Command and other “like-minded countries” to disrupt the activities of the Russian group.

Also read: Centre planning strategies to tackle cyber attacks by ‘Chinese hackers’

“But since we have today at 17.10 from 12:00 Moscow time, someone brought up the hidden-services of a landing and a blog with the same keys as ours, my fears were confirmed. The third party has backups with onion service keys,” a threat actor affiliated with the REvil operation posted on an underground hacking forum.

The threat actor then said that the ransomware operators have now decided to shut down the operation.

Ransomware groups like REvil team up with hackers to paralyze companies all over the world and this offensive led by the US only meant to end their reign of terror in the cyber world.

Also read: Cyber attack at Dr Reddy’s ahead of human trials of COVID-19 vaccine

This is the second occasion when REvil has been forced to go offline. It reappeared only last month after being offline for most of the two months.

But all was not good with the ransomware group, which was struggling to find threat actors to work with them, despite hiking affiliate’s commission to 90%, reported techradar.com.