Skip to Content
Computing

The world’s biggest ransomware gang just disappeared from the internet

The shutdown comes one day before US and Russian officials meet to talk about the ransomware crisis.

Photo by Jordan Harrison on Unsplash

One of the most prolific ransomware gangs in the world suddenly disappeared from the internet on Tuesday morning. The unexplained exodus comes just one day before senior officials from the White House and Russia are scheduled to meet to discuss the global ransomware crisis.

The ransomware crew known as REvil has existed for years in the booming cybercrime underground. A whopping 42% of all recent ransomware attacks trace back to this gang, but they're known for two hacks in particular. Earlier this month, the gang hit at least 1,000 businesses by attacking the software company Kaseya. It was one of the widest ransomware campaigns ever conducted. And last month, REvil hit the meat supplier JBS and demanded payment of $11 million. Even as world leaders turned their attention to ransomware and threatened action, REvil was defiant—until now.

“It’s a bit of a mess as we scramble to figure out what’s happening,” says Allan Liska, senior threat analyst at the security firm Recorded Future. “We’re cautiously optimistic that one of the biggest gangs out there is done.” 

There are a few possible explanations for what caused today’s shutdown. First, the gang itself may have chosen to retire if they’ve made enough money or felt too much pressure. The United States or its allies may have successfully taken them offline. Or the Russian government, under international scrutiny, may have forced them to shut down. Their disappearance could also be temporary—many cybercriminals pretend to "retire" before eventually reappearing under new identities.

“We recommend not jumping to any immediate conclusions as it’s early, but REvil is, indeed, one of the most ruthless and creative ransomware gangs we’ve ever seen,” says Ekram Ahmed, a spokesperson at Check Point Software.

The answer is unclear and the broader problem of ransomware still looms large.

“I don't know what this means, but regardless, I'm happy!” tweeted Katie Nickels, director of intelligence at the US firm Red Canary. “If it's a government takedown - awesome, they're taking action. If the actors voluntarily went quiet - excellent, maybe they're scared. It's still important to remember that this doesn't solve ransomware.”

All of the websites used by the REvil gang, including where the group publishes stolen data, are now offline. Even more significant, though, is that all of the infrastructure and computers that the gang uses to conduct attacks went offline at around 8am Moscow time on Tuesday morning, Liska explains. The group’s spokesperson has also been inactive for nearly a week.

“Ransomware sites are hosted by bulletproof hosting and they’re flaky, they all go up and down,” says Liska. “But they never all go up and down at the exact same time.”

REvil is a Russian-speaking group, the malware they write avoids Russian computers, and they are linked to other groups believed to be inside Russia. After this month's massive attack, White House press secretary Jen Psaki said, “If the Russian government cannot or will not take action against criminal actors in Russia, we will take action or reserve the right.”

With tomorrow’s US-Russia summit slated to focus on ransomware, it looks like the conversation may be different than was originally expected.

“The timing is fascinating. It’s right after the Kaseya attack and right before tomorrow’s summit," Liska says. "They just conducted arguably the biggest ransomware [attack] in history. To go from that high to being shut down, I think that’s not coincidental.”

Deep Dive

Computing

Conceptual illustration of quantum computing circuity, in multiple colors
Conceptual illustration of quantum computing circuity, in multiple colors

Quantum computing has a hype problem

Quantum computing startups are all the rage, but it’s unclear if they’ll be able to produce anything of use in the near future.

winning team for Pwn2own 2022
winning team for Pwn2own 2022

These hackers showed just how easy it is to target critical infrastructure

Two Dutch researchers have won a major hacking championship by hitting the software that runs the world’s power grids, gas pipelines, and more. It was their easiest challenge yet.

child outside a destroyed residential building in Kiev
child outside a destroyed residential building in Kiev

Russia hacked an American satellite company one hour before the Ukraine invasion

The attack on Viasat showcases cyber’s emerging role in modern warfare.

Russia is risking the creation of a “splinternet”—and it could be irreversible

If Russia disconnects from—or is booted from— the internet’s governing bodies, the internet may never be the same again for any of us.

Stay connected

Illustration by Rose WongIllustration by Rose Wong

Get the latest updates from
MIT Technology Review

Discover special offers, top stories, upcoming events, and more.

Thank you for submitting your email!

Explore more newsletters

It looks like something went wrong.

We’re having trouble saving your preferences. Try refreshing this page and updating them one more time. If you continue to get this message, reach out to us at customer-service@technologyreview.com with a list of newsletters you’d like to receive.