This is pretty big news, over the weekend the biggest name in cybercrime was taken completely
offline, courtesy of the Russian secret service agency: the FSB.
Now this is a surprising plot twist, because Russia has over the past few years become
a well known safe haven for cybercriminals.
It’s become a bit of of an unwritten rule that as long as Russian blackhats didn’t
target Russian citizens or Russian companies, and instead focused their money making attacks
on the rest of the world (usually with ransomware), they were largely allowed to exist by Russian
authorities - that is, until a couple of days ago when the rEvil ransomware group, or R
Evil - I call them revil, because I mispronounced them the first time I talked about them, and
it’s kinda stuck, but anyway.
In a sting that was caught entirely on camera, Revil members had their homes raided, stacks
of cash were seized, as well as crypto wallets, all totalling millions of dollars.
You can even see the exact moment a revil member answers a knock at the door only to
be raided by secret police.
14 Revil members were arrested in total - these guys are supposedly responsible for some of
the biggest and most impactful ransomware attacks in the entire history of the internet.
Some of their greatest hits include: exfiltrating and leaking top secret Apple schematics, hacking
US nuclear weapons contractors, the colonial pipeline hack and of course the Kaseya ransomware
attack in which the hackers claim to have ransomed a million computers.
Notice how none of these hacks target Russians, if they had then they probably would’ve
been shut down a long long time ago.
The obvious questions are, why have the authorities waited until now to take action?
And, how big of a deal is this really?
I know I said this is big and surprising news, but does this takedown signal the end of cybercrime
as we know it?
Well, as for the first question, why now?
Has Putin suddenly developed sympathies for US companies falling prey to ransomware?
Probably not.
The best answer to the question of ‘why’ goes beyond cybercrime, the running theory
is that this is purely politically motivated.
Russian relations with the US have never been amazing, but at the moment they’re not particularly
good.
The fact that Putin has the ability to disarm these cybercrime gangs is a major card on
the negotiation table with the US.
And let’s be real these cyber attacks originating from Russian gangs are no joke.
Take the colonial hack for example, a Russian cybercrime gang effectively shut down a major
US pipeline, causing fuel shortages and a run on gas stations in certain states.
Through what is probably wilful neglect on the part of the Russians or maybe it really
is top tier strategy - who knows, their cybercrime industry has grown into a real threat to the
West.
By taking down revil, Putin is signalling that Russia can and will take down these gangs
if they feel like it, and now it’s up to the US to make them feel like it at the negotiating
table.
But then there’s the question of whether taking down revil will have any real impact
on cybercrime, after all, revil has been responsible for some major hacks, surely taking them out
means large organisations can breathe a sigh of relief.
The reality is that this action is largely symbolic, even before this takedown, revil
themselves had become largely irrelevant.
As after the monumental Kaseya ransomware attack, revil disappeared, now they did spring
up again a few months later.
But by disappearing they lost a lot of credibility in the cybercriminal underworld, and their
affiliates weren’t happy - some reported that revil refused to pay them and just ran
away with their cut of the spoils.
Things were so bad for revil that this previously famous and respected cybercrime gang was forced
to increase the share of commission they offer in a bid to even attract affiliates.
Remember affiliates are the ones who spread ransomware on behalf of a cybercrime gang,
usually affiliates get 70 to 80% of the takings, but revil had gone so far as to offer 90%.
However it turns out that in this reboot of their operations, they had restored from a
backup which just so happens to have been compromised by the FBI, giving the bureau
complete access to their infrastructure - the FBI then shut down their operations in October.
Making Revil’s return rather short-lived.
And so at the time of the Russian raids a few days ago, revil was no longer even operating.
Whilst sure, the arrests of the 14 Revil members takes some experienced cybercriminals off
the internet - it was more so done for theatre than anything else.
Researchers undercover on various blackhat forums confirm that in the words of Russian
cybercriminals revil members were just “pawns in a big political game”.
So no, the internet is no safer from ransomware today as it was yesterday.
This video is sponsored by Linode, who are giving you $100 worth of free cloud computing.
Linode is a totally customisable cloud hosting platform - whether you’re looking to quickly
spin up a VPN, website or host a kubernetes cluster - Linode has you covered.
If it runs on linux it’ll run on linode.
Linode just announced availability of their NVME block storage, the first alternative
cloud provider to officially support this state of the art hardware.
Linode’s philosophy is to focus on providing all the tools a developer really needs at
competitive prices.
Use the link in the description now to claim your free $100.
As always you know what to do, tickle the like button, fondle the notification bell,
all that fun stuff, and I’ll see you in the next video, have a good one.