Russia has arrested REvil ransomware gang members, citing requests from US authorities.
Russia’s Federal Security Service (FSB) announced the news on Friday, as footage of the arrests hit local airwaves. The video shows Russian agents nabbing several suspects at their homes and seizing large amounts of cash.
The FSB says the “basis of the search” came from an appeal from US authorities, who had information on the leader of REvil and the group’s efforts to hack foreign tech companies.
The US Department of Justice and FBI did not immediately respond to a request for comment. But if true, the arrests mark a rare instance of the US cooperating with Russian authorities to stop a cybercriminal operation.
It might also be the first time Russia has ever publicly cracked down on a ransomware gang based within the country. The US has long accused Russia of letting cybercriminals within its borders operate with impunity. The Kremlin itself has also implied it’ll recruit criminal hackers for government operations.
The FSB didn’t name any of the arrested suspects. However, the Russian security service says it “established the full composition of the REvil criminal community,” suggesting the main leaders behind the gang have been detained.
The FSB added that the crackdown encompassed 25 different addresses belonging to 14 members of the ransomware group. The seized funds included $600,000 in US dollars, another 500,000 in Euros, and 426 million in Russian rubles (US$5.6 million). Russian authorities also confiscated the gang’s computer equipment and 20 premium cars the suspects allegedly purchased with their ill-gotten gains.
The FSB didn't say whether it’ll extradite any of the suspects to the US. But they’ve been charged with "illegal circulation of means of payment."
REvil is allegedly behind numerous high-profile ransomware campaigns, including the attack on IT management solutions provider Kaseya, which saw hundreds of its clients hit with malware.
REvil also stole confidential documents from victims and threatened to leak the information online unless ransoms were paid. It also recruited "affiliates" to distribute ransomware payloads, offering a split in revenue from funds earned with each successful attack.
The gang’s widespread hacking activities prompted the Biden administration in July to order US intelligence agencies to investigate REvil. In November, the DOJ then announced it helped nab a Ukrainian who had been using REvil’s ransomware to attack various companies. A separate Russian suspect was also charged for conducting attacks with the REvil ransomware strain.