REvil, shut down and disappears

REvil, the prolific ransomware strain behind the recent attacks on Kaseya and JBS, has gone dark. That attack prompted U.S. President Biden to demand that President Putin shut down his ransomware and other hacking groups that attack American targets in a two-hour phone call last week.

It is not entirely clear to date why REvil unexpectedly went offline, but cybercrime experts of the private intelligence and investigation US firm ARTEFAKTUM, Boston, present three main possible theories.

The first is that the U.S. Cyber Command, cooperating with law enforcement, brought the sites down after Biden's order; when asked by a reporter the other day if Biden would give the order if Russia did not remove REvil, Biden simply replied "yes."

The second is that Putin ordered the sites taken down.

And the third is that REvil shut itself down to avoid being caught in the crossfire of two world powers, much like Darkside did after the Colonial Pipeline hack in the past.

There is no evidence that the sites were seized by any authority, neither in the US nor in Russia, and sources within the U.S. Cyber Command said they were not expecting any guidelines until later in the week.

ARTEFAKTUM LLC
Media Team
177 Huntington Ave
Boston, MA 02115
mail at artefaktum.net
T: +1 617 861 9250

With its headquarters in Boston (MA) and subsidiaries in London, Hong Kong, and Berlin, Artefaktum was founded by former leaders of government agencies, law enforcement, industry veterans, and lawyers, combining the professionalism of a big firm with the flexibility, discretion, and independence of a boutique.
Artefaktum provides intelligence to enable transactions in unfamiliar markets and with new business partners, leading in investigating large complex fraud cases, unusual threats, or suspected corporate wrongdoing, providing cybersecurity and risk management professional services.

This release was published on openPR.