The global fight against ransomware took a new twist this week with the United States leading a law enforcement effort to hack back and disrupt the extortion group behind the Colonial Pipeline cyberattack.
SecurityWeek has confirmed a Reuters report that the Tor servers associated with the REvil ransomware gang were seized in what was described as a “multi-country” hack-back operation that remains active.
The ransomware group’s public blog, which was used to name-and-shame organizations into paying multi-million data recovery ransoms, was knocked offline. A goodbye message from one of the operators read: “The server was compromised, and they were looking for me. Good luck, everyone; I’m off,”
Threat hunters tracking underground human-operated ransomware operations confirmed the REvil shutdown, which was carried out by foreign partner of the U.S. government.
Several other competing ransomware groups responded to the REvil network takeover by moving cryptocurrency reserves and even publicly complaining about the hack-back operation.
[ READ: Colonial Pipeline CEO Explains $4.4M Ransomware Payment ]
The infamous REvil gang was caught using the Darkside data encryption tool in human-operated ransomware attacks against multiple U.S. companies. These included the Colonial Pipeline cyberattack that forced a shutdown of gas stations and the Kaseya supply-chain compromise.
Law enforcement officials are avoiding comment on the takedown, citing the active nature of the operation.
In response to the hack, Colonial Pipeline shelled out $4.4 million to purchase a decryption key to recover from the cyberattack that caused gasoline shortages in parts of the United States.
The REvil takedown comes as the U.S. government identified approximately $5.2 billion in outgoing Bitcoin transactions that are potentially linked to ransomware payments, mostly to cybercriminal gangs in Russia and Eastern Europe.
Related: Cyberattack Forces Shutdown of Major U.S. Pipeline
Related: Tech Audit of Colonial Pipeline Found ‘Glaring’ Problems
Related: Industry Reactions to Ransomware Attack on Colonial Pipeline
Related: Colonial Pipeline CEO Explains $4.4M Ransomware Payment
Ryan Naraine is Editor-at-Large at SecurityWeek and host of the popular Security Conversations podcast series. He is a journalist and cybersecurity strategist with more than 20 years experience covering IT security and technology trends.
Ryan has built security engagement programs at major global brands, including Intel Corp., Bishop Fox and Kaspersky GReAT. He is a co-founder of Threatpost and the global SAS conference series. Ryan’s career as a journalist includes bylines at major technology publications including Ziff Davis eWEEK, CBS Interactive’s ZDNet, PCMag and PC World.
Ryan is a director of the Security Tinkerers non-profit, and a regular speaker at security conferences around the world.
Follow Ryan on Twitter @ryanaraine.
Tags: http://feedproxy.google.com/~r/securityweek/~3/zwhlxK4c3_Y/revil-ransomware-gang-hit-law-enforcement-hack-back-operation