The infrastructure and leak sites used by the REvil ransomware gang for its operations went offline last night.
Starting last night, the infrastructure and the websites used by the REvil ransomware gang were mysteriously unreachable, BleepingComputer first reported.
“The REvil ransomware operation, aka Sodinokibi, operates through numerous clear web and dark web sites used as ransom negotiation sites, ransomware data leak sites, and backend infrastructure.” reported BleepingComputer. “Starting last night, the websites and infrastructure used by the REvil ransomware operation have mysteriously shut down.”
So, all of the REvil sites have been down since around 1:00 AM (EST), which is 8:00 AM Moscow time. It is almost like Unknown came into the office today and decided to "shut it down, shut it all down!" pic.twitter.com/L5BxOluVhn
— Allan “Ransomware Sommelier🍷” Liska (@uuallan) July 13, 2021
The Tor leak site, the payment website “decoder[.]re”, and their backend infrastructure went offline simultaneously.
At the time of this writing, it is not clear if the operators shut down the operations due to the pressure of law enforcement after the recent Kaseya massive ransomware attack or if the infrastructure was seized as a result of an operation conducted by law enforcement.
However there is no banner of the websites used by REvil that informs visitors of the seizure of the infrastructure by the authorities.
As part of the Kaseya attack, REvil ransomware operator demanded $70 million for a universal decryptor that could be used by all the organizations impacted by the attack.
The victims of the attack opted out to do not pay the ransomware and while the law enforcement are investigating the case.
We cannot exclude that the cybercriminals decided to temporarily disappear due to the ongoing investigation, or that some members of the gang decided to leave it fearing of being arrested.
Follow me on Twitter: @securityaffairs and Facebook
(SecurityAffairs – hacking, REvil ransomware)
Share On
Pierluigi Paganini
Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at “Cyber Defense Magazine”, Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog “Security Affairs” recently named a Top National Security Resource for US. Pierluigi is a member of the “The Hacker News” team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books “The Deep Dark Web” and “Digital Virtual Currency and Bitcoin”.
The infrastructure and leak sites used by the REvil ransomware gang for its operations went offline last night.
Starting last night, the infrastructure and the websites used by the REvil ransomware gang were mysteriously unreachable, BleepingComputer first reported.
“The REvil ransomware operation, aka Sodinokibi, operates through numerous clear web and dark web sites used as ransom negotiation sites, ransomware data leak sites, and backend infrastructure.” reported BleepingComputer. “Starting last night, the websites and infrastructure used by the REvil ransomware operation have mysteriously shut down.”
So, all of the REvil sites have been down since around 1:00 AM (EST), which is 8:00 AM Moscow time. It is almost like Unknown came into the office today and decided to "shut it down, shut it all down!" pic.twitter.com/L5BxOluVhn
— Allan “Ransomware Sommelier🍷” Liska (@uuallan) July 13, 2021
The Tor leak site, the payment website “decoder[.]re”, and their backend infrastructure went offline simultaneously.
At the time of this writing, it is not clear if the operators shut down the operations due to the pressure of law enforcement after the recent Kaseya massive ransomware attack or if the infrastructure was seized as a result of an operation conducted by law enforcement.
However there is no banner of the websites used by REvil that informs visitors of the seizure of the infrastructure by the authorities.
As part of the Kaseya attack, REvil ransomware operator demanded $70 million for a universal decryptor that could be used by all the organizations impacted by the attack.
The victims of the attack opted out to do not pay the ransomware and while the law enforcement are investigating the case.
We cannot exclude that the cybercriminals decided to temporarily disappear due to the ongoing investigation, or that some members of the gang decided to leave it fearing of being arrested.
Follow me on Twitter: @securityaffairs and Facebook
(SecurityAffairs – hacking, REvil ransomware)