Hello world, it’s not often the FBI launches offensive hacking campaigns targeting cybercriminals,
but in the past week they’ve done just that. This is the story of how one of the world’s
most notorious ransomware gangs rEvil was pwned by the feds - in response rival cybercriminal
gangs have called on blackhats to unite against the US and collectively target American critical
infrastructure, dare I say, begun the ransomware wars have?
For a quick backstory on rEvil, in Q1 this year they accounted for 4.6% of all ransomware
attacks, some of their biggest hits include stealing Macbook schematics from a taiwanese
manufacturer, hacking JBS - the worlds’ largest meat supplier, and of course the Kaseya
ransomware attack in which remote management software used by thousands of organisations
was compromised, leading to an unprecedented situation in which (according to revil’s
own numbers) 1 million computers were held to ransom.
That’s one way to get the attention of the FBI, who themselves mysteriously managed to
get a hold of a set of decryption keys for all computers infected during the Kaseya ransomware
attack, though this came a little too late - the keys were made available to companies
weeks after the initial hack, when most had taken alternative measures like restoring
from backups, rebuilding their systems or in some cases even paying the ransom.
We now know that the FBI had in fact refrained from publishing the keys for almost 3 weeks
after procuring them, sacrificing the victims so as to not tip revil off to their grand
plan, which we’ll get to shortly. In the wake of the enormous Kaseya hack, revil vanished,
the reasons for which were unclear, maybe there was some internal feud between gang
members, or perhaps given the attention they had brought upon themselves they had deemed
their business too risky, and so cashed out and retired.
Fast forward a couple of months and rEvil resurrected themselves, the blog on which
they post details of their victims mysteriously came back online. Having tarnished their reputation
by disappearing, the gang was desperate to seduce potential ransomware affiliates to
spread their malware, offering unusually high commissions of 90% to attract affiliates - usually
only 70-80% is offered.
However, revil made one fatal flaw on their return. They restored from backups - backups
which had been compromised by the FBI in their earlier operation, in doing so the FBI was
in control of some of Revil's infrastructure. Ironically, the gang’s own tactic of attacking
backups had been used against them. Revil will have known their systems had become public
enemy number 1 after the kaseya hack, for them to resurrect the same systems that had
been under so much scrutiny was a big mistake.
Once one Revil member realised they had been compromised he posted some confused messages
on the XSS cybercrime forum, guessing that a disgruntled Revil member previously thought
to be dead was somehow behind the hack.
This was the working theory until reuters posted an article exposing how "The FBI, in
conjunction with Cyber Command, the Secret Service and like-minded countries, have truly
engaged in significant disruptive actions against these groups,” as explained by an
adviser to the U.S. Secret Service. This all comes just a few months after it was announced
the US was to give combatting ransomware attacks a similarly priority to fighting terrorism.
Creating a new centrally coordinated task force to address the cybercrime scourge.
Frustratingly and unsurprisingly I suppose, the FBI isn’t spilling any beans on how
the operation against revil was carried out, the only nugget we have on that thread is
a reuters source claiming “a foreign partner of the U.S. government carried out the hacking
operation that penetrated REvil's computer architecture.” Though given the shroud of
secrecy here - no doubt it is an ongoing operation - other than successfully knocking rEvil offline
- again, there seems to be no other direct consequences of the operation.
However, these events are most certainly causing a stir in the underground cybercriminal community.
Fearing they may be next, other ransomware gangs have reacted, in particular the Darkside
and blackmatter gangs have been moving large chunks of their bitcoin in a possible sign
they may be looking to cash out, approximately $6.8m worth has been shifted thus far.
Some gangs have even threatened reprisals against the US for this operation, the groove
ransomware gang has posted some strong words on their dark web site. It reads "In our difficult
and troubled time when the US government is trying to fight us, I call on all partner
programs to stop competing”, “unite and start effing up the US public sector,”,
You can pause the video and read it in full if you like, they essentially propose that
fellow ransomware gangs band together and target US public sector organisations. Be
that, hospitals, law enforcement or infrastructure - we’ll have to see. I can’t help but
feel this is just one guy throwing a tantrum and nothing will come
of it. But if I’m wrong, begun the ransomware wars have.