Russia takes down REvil hacking group at U.S. request

Russia has conducted a special operation against ransomware crime group REvil at the request of the United States and has detained and charged the group’s members, Russia’s Federal Security Service (FSB) said on Friday (Jan 14).

The arrests were a rare apparent demonstration of collaboration between Russia and the US, at a time of high tensions between the two over Ukraine.

The announcement came even as Ukraine was responding to a massive cyber attack that shut down government websites, though there was no indication the incidents were related.

A joint police and FSB operation searched 25 addresses, detaining 14 people, the FSB, Russia’s domestic intelligence service, said, listing assets it had seized including 426 million roubles (S$7.5 million), US$600,000 (S$808,000), 500,000 euros (S$770,000) , computer equipment and 20 luxury cars.

Russia had informed the US directly of the moves it had taken against the group sought by Washington, the FSB said on its website.

“The investigative measures were based on a request from the… United States,” the FSB said. “The organised criminal association has ceased to exist and the information infrastructure used for criminal purposes was neutralised.”

The REN TV channel aired footage of agents raiding homes and arresting people, pinning them to the floor, and seizing large piles of dollars and Russian roubles.

The group members have been charged and could face up to seven years in prison.

A source familiar with the case told Interfax that the group’s members with Russian citizenship would not be handed over to the US.

The US said in November it was offering a reward of up to US$10 million for information leading to the identification or location of anyone holding a key position in the REvil group.

The US has been hit by a string of high-profile hacks by ransom-seeking cybercriminals.

A source with direct knowledge of the matter told Reuters in June that REvil was suspected of being the group behind a ransomware attack on the world’s biggest meat packing company, JBS SA.

Washington has repeatedly accused the Russian state in the past of malicious activity on the internet, which Moscow denies.

Russia’s announcement comes during a standoff between the US and Russia. Moscow is demanding Western guarantees including that Nato will not expand further. It has also built up its troops near Ukraine.