FSB arrests REvil ransomware gang members

https://therecord.media/fsb-raids-revil-ransomware-gang-members/

by _____k • 5 years ago

193 166 5 years ago

chmod7752• 5 years ago

The raid comes after President Biden and US authorities have pressured Russian President Vladimir Putin repeatedly over the summer to crack down on the Russian underground cybercrime ecosystem, which harbors many of today’s top ransomware crews.

Oof. After that call Putin must've forgot to tell the FSB to not lift a finger for a while, because you just know his American colleagues will jump at the chance to credit this to themselves.

Predictably, it's happening.

apstls• 5 years ago

These arrests would absolutely not have happened without US pressure.

chmod7752• 5 years ago

Really? You think the same country that acts like this[1] gives a rat's ass about some criminals the US wants to see arrested?

Can't wait for them to arrest Snowden next.

[1] https://www.courthousenews.com/russia-us-talks-end-with-impa...

Tepix• 5 years ago

Hopefully we'll see an improvement in the relations between Russia and the West.

It will be interesting to see how the (alledgedly mostly russian) ransomware industry fares after this new development.

guerrilla4• 5 years ago

That's never going to happen if Europe and Russia aren't allowed to integrate their economies further. Until they do, geography will dominate[1] and NATO and Russia will continue to press each other.

1. https://www.youtube.com/watch?v=HE6rSljTwdU

jopsen• 5 years ago

if Europe and Russia aren't allowed to integrate their economies further.

"allowed"? To a large extend Russian behavior scares the EU away.

enkid2• 5 years ago

The Russians are using their economic integration to try to get away with geopolitical shenanigans. The idea that deeper integration would stop this is ridiculous. Russia having more leverage would drag the EU into more conflict, it seems like.

r721• 5 years ago

Video: https://twitter.com/campuscodi/status/1481989170876882944

blinding-streak• 5 years ago

Do police always film their raids? I doubt it. This almost seems like a TV show. My propaganda spidey sense is going off.

kgeist5• 5 years ago

In Russia, they actually do film raids/arrests. It's later used in court I think. It's pretty common, they do it with low profile criminals, too. There's a special officer with a camera filming everything. You can find plenty of such videos on Youtube.

Dma54rhs• 5 years ago

Think it's common all around Europe,it will be used as evidence.

smokey_circles• 5 years ago

Uh... bodycam footage is somehow different?

nitwit005• 5 years ago

In this case there may have been a concern about cops wandering off with some of the cash. Note the effort to film finding and counting the money.

ogurechny• 5 years ago

You are wrong about the filming (it is regularly done across the whole world, if only for the good publicity on TV screens), but your spidey sense might be correct.

FYI, the Russian-language discussions are about whether the whole thing was staged, or only part of it. In other words, they could have actual contacts with protection, and share the money, or they could be observed silently, and maybe controlled through private talks with the leadership. So people try to guess whether members were prepared for the show arrest, or weren't.

Mafia (legal or illegal) does not care about blockchains and exploits, mafia knows that money don't appear out of thin air. When there's a need to launder the money to have those piles of cash, the word of mouth reaches the relevant people. It's not about secret services or international cyber-mumbo-jumbo, it's first and foremost about the money.(Whoop-whoop, capitalism and free market!)

Also, those kinds of relations don't go unnoticed. When there's a need to launder the money to have that expensive real estate in a Western country, the word of mouth reaches the relevant people. The dossier on hackers was not an offer, it was an ultimatum. “Either deal with them, or we are leaking the data on top government officials who benefit from hacking, and making lots of fuss and property seizures”. As they probably met with the same people whose data was supposed to be leaked, it had an effect.

So there is very little “justice” going on, just the same old “the strong reigns over the weak”. How can other commenters rush to discuss cardboard games of “international politics” and to play with hand dolls of “US”, “Russia”, and “China” with such a childlike joy is a mystery to me. These things exist in media propaganda universe, they are not real.

breakpointalpha• 5 years ago

I can't help but marvel at how terrible the OpSec on display is here.

Hoards of cash in drawers and bags?

Open laptops with logged in crypto accounts?

Maybe they only showed the few dummies on the team that didn't follow protocol, but all it takes is one idiot to ruin the whole "teamwork" vibe...

q1w23• 5 years ago

I think people really over-estimate the qualifications of these gangs. What made them successful was never their skills - it was their jurisdictional immunity.

They believed that as long as they did not target Russia (or CIS countries), that the Russians would not crack down.

What stops most hackers from orchestrating massive attacks, is the threat of arrest and prison.

For those most highly skilled IT folks, the income difference between a legitimate cybersecurity job and ransomeware engineer, is not enough to justify the risk.

p1peridine• 5 years ago

@1:20 guy is squatting while counting the money.

https://reddit.com/r/slavs_squatting/

2OEH8eoCRo0• 5 years ago

Heels are on ground. Legit

raverbashing2• 5 years ago

That's an interesting timing given the bigger context.

Sure, the right hand does not talk to the left hand most of times and there's a "separation of concerns", still, there might be something to it.

Anyway, this is an important step in fighting cybercrime.

ericbarrett• 5 years ago

Yes, this must surely be a concession or a "show of good faith" from the recent U.S.-Russia summit.

From here, Russia (Putin) can either prosecute or release the members depending on how the talks go.

denton-scratch9• 5 years ago

I agree.

I think Putin and Biden may have come to an agreement similar to the one reached between JFK and Kruschev to end the Cuban Missile Crisis. You withdraw your missiles from Cuba now, and we'll withdraw missiles from Turkey - but in 6 months' time, so we don't lose face. So I suspect these arrests are a confidence-building measure.

I predict that tensions will ease visibly in about 6 months.

doitLP• 5 years ago

“Representatives of the competent US authorities were informed about the results of the operation,” the agency said.

That’s a nice thing to say. Respect for your adversary, trolling or mistranslation?

d_watt• 5 years ago

Competent Authority is a legal term referring to the agency/group that has authority in the given area.

xwolfi• 5 years ago

Understand "relevant".

kingofpandora• 5 years ago

What's trolling about that?

_RPL5_• 5 years ago

A poor translation. From Russian wikipedia [1]:

"""

Competent authorities are executive authorities endowed with jurisdiction and power to perform any specific tasks (“competence” here means “the right to make decisions”).

"""

[1] https://ru.wikipedia.org/wiki/%D0%9A%D0%BE%D0%BC%D0%BF%D0%B5...

whimsicalism• 5 years ago

I am incredibly surprised that they would arrest a cybercrime gang largely targeting people outside of Eastern Europe. My impression was that such crime was tolerated as long as it wasn't directed inwards.

scyzoryk_xyz• 5 years ago

See -> Ukraine/NATO situation and negotiations

ianhawes• 5 years ago

It generally is, but you need to quell the flames from time to time. When it became a liability for Russia, likely from the high profile attacks over the past 12 months, you have to act.

My guess is:

- No one is extradited.

- Sentences, if any, are minimal.

- Whatever data collected by these guys is now in the hands of RU intelligence.

- The smarter/competent ones are recruited.

The raids are also interesting because you don't see the same flamboyance we saw from eastern European carders after their raids. Wheres the pet tiger? And the foreign sports cars? I'm curious if perhaps this was a raid on the lower level personnel.

Or maybe this was completely staged and none of these people are associated with REvil at all.

dbsmith83• 5 years ago

The raids are also interesting because you don't see the same flamboyance we saw from eastern European carders after their raids. Wheres the pet tiger? And the foreign sports cars?

The article mentions:

"Authorities said they seized more than 426 million rubles, $600,000, and €500,000 in cash, along with cryptocurrency wallets, computers, and 20 expensive cars."

I doubt they were all lower-level personnel

unionpivo• 5 years ago

- Sentences, if any, are minimal.

yeah not in Russia. They don't go easy on people, even if its for "show". This people are f**.

sybercecurity• 5 years ago

In addition, REvil and some other crews have targeted some Chinese companies. China has a different relationship with Russia compared to the US and Russia. China grumbling can probably get more results. Adding that to the reasons in the article means that certain ransomware gangs have become too toxic right now and need to be reined back in.

eps• 5 years ago

This has gotta be related to the Russia's recent demands to Nato on Ukraine and resulting negotiations [1]. They yield here, the counterpart yields there.

REevil arrest is just a token of good will, probably in exchange for something.

[1] https://www.bbc.com/news/world-europe-59985589

q1w23• 5 years ago

There's no downside to arresting them.

You seize their assets. You seize their talent and force them to work for the FSB. ...and you get to pretend to the world that you crack down on international hackers.

It's only upside for Russia.

3233• 5 years ago

The FSB, which serves as Russia’s internal intelligence agency, said it conducted its operation at the request of US authorities

This needs to be understood through the Ukraine/NATO crisis lens.

Carrot and stick.

Show that you can act both in a "good" or "bad" way.

brotoss• 5 years ago

Elaborate?

boringg2• 5 years ago

Good that they are cracking down on ransomware gangs; bad that they are looming over an invasion of ukraine.

eganist2• 5 years ago

Rus: "We'll support you with your interests if you at the very least turn a blind eye to ours"

That's my naive read, anyway.

pluc• 5 years ago

Russia doesn't usually care much about its nationals hacking outside of its borders.

shin_lao2• 5 years ago

More like the US put a gun on Russian head and told them "we can hurt you more than you can hurt us".

Russia infrastructure is old and the country is very corrupt. Wouldn't be surprised there was a "proof of concept" to show they mean business.

nix233• 5 years ago

Being downvoted for having a neutral view....

konart2• 5 years ago

The US has not gun at the moment. They have their own share of problems with China and any conflict in Europe is not in their interest. Not saying that Russia has all the card or anything like that too.

onphonenow2• 5 years ago

If you think the American people want another nation building exercise far away from us (while Germany busily buys Russia gas through Nord Stream 2 and dems block sanctions on it) think again.

A few quick points.

The US has a lot to lose here. This area is in russia's back yard, not ours. If we fight on the ground (without speaking the local language - Russian) we are back into our afghan / syria stuff.

Russia has nuclear weapons. If you say you can blow russia away think again. And again, the US has a LOT to loose, I suspect the russian populace would be able to deal with casualities etc better than the US.

When we say we are going to cut them off financially, realize that a huge amount of energy flows from Russia to Europe. And especially if they go after Ukraine then, they would have enormous control over EU energy markets. Again, not saying EU couldn't handle it, but do they have the stomach for this?

Germany BTW has shut DOWN a lot of their zero carbon nuclear power (to be "green") so they are now more dependent then ever on natural gas.

Does President Biden have the popularity and support of his caucus to start a war? Bernie Sanders is on board with this?

The US did this huffing already with Crimea.

They did this with Afghanistan where we were assured repeatedly that NO evacuation was underway while we literally watched an evacuation.

The confusing thing to me in all this is, where is Europe? France always want to be a bigger player internationally - this is a chance for the EU to demonstrate some soft or hard power if they wanted.

If there was something going on with mexico in our backyard, I can't even imagine us not getting involved (or cuba - we'd def push back on Russia putting stuff there).

coldtea2• 5 years ago

More like the US put a gun on Russian head and told them "we can hurt you more than you can hurt us".

2022 US? Yeah, the President's geriatrician is right on it...

birdyrooster2• 5 years ago

Especially considering the support US is giving its domestic hackers. Russia knows this isn’t an arms race they want to be part of. Look at our recent spin-up for maritime privateering to counter China, you know we could ramp up attacks on Russian industry and commerce with cyber too.

mzs• 5 years ago

cooperation

“As a result FSB and Min of Internal Affairs effotts, REvil ceased to exist, their infrastructure was neutralized,” per RIA
An “informed source” told Interfax that Russia won’t extradite detained members of REvil with Russian passports to the US. Source didn’t specify whether all the detained hackers are Russians.

Mary Ilyushina · @maryilyushina · 6:57 AM · Jan 14, 2022

https://twitter.com/maryilyushina/status/1481973752292417543

kgeist5• 5 years ago

IIRC Russian law prohibits extradiction and there's no treaty between US and Russia.

rafale• 5 years ago

They are probably not gonna serve jail time. Their brains are too valuable. They will likely get a desk at the FSB headquarters.

pelasaco2• 5 years ago

for sure they are going to work for FSB

sdenton4• 5 years ago

New acqi-hiring strategies coming soon to a megacorp near you!

hooande• 5 years ago

Their brains are too valuable.

lol. don't make them out to be geniuses. REvil was basically a successful startup. not even a unicorn AND it's going to land them in prison for some amount of time.

Putin showed Biden that's he's acting in good faith. No one at that level cares what happens to a bunch of hackers

tablespoon• 5 years ago

They are probably not gonna serve jail time. Their brains are too valuable. They will likely get a desk at the FSB headquarters.

A raid like this would be a really stupid way to "acqui-hire" some hackers. My understanding is a lot of these hackers already work with the FSB, etc. Using outside people helps the FSB by giving them a level of deniability.

shawnk• 5 years ago

Fake news. Show us some proof. Can’t trust words anymore

Croftengea3• 5 years ago

The funniest part:

charged with committing crimes under Part 2 of Art. 187 ‘Illegal circulation of means of payment’

Joker_vD2• 5 years ago

That article is about forging/counterfeiting cards/cheques/whatever that's not cash but can be used for payment, so... what is funny about that?

Croftengea3• 5 years ago

It's like arresting Al Capone for tax evasion.

qwertox2• 5 years ago

I wonder if this is related to "Ukraine: 'Massive cyber attack' shuts down government websites" [0] [1].

If this was Russia, then they would probably use the REvil "arrests" as a proof that they don't engage in Cyberwarfare, but rather help the world become a better place by cleaning up the Cyberspace.

Edit: TBH, that Twitter video in the other comment looks pretty serious.

[0] https://news.sky.com/story/ukraine-says-massive-cyber-attack...

[1] https://therecord.media/hackers-deface-ukrainian-government-...

capableweb6• 5 years ago

I don't think anyone (including the Russians themselves) think this can be used as proof they don't engage in cyberwarfare. That's like saying that because the FBI (or whoever deals with cybercrime in the US) arrested some domestic hacking group on US soil, the NSA doesn't do any offensive hacking in other countries. No one would think that, so why should anyone think that of Russia?

arcticbull• 5 years ago

I don't think anyone (including the Russians themselves) think this can be used as proof they don't engage in cyberwarfare.

This is how Russian propaganda works. Not just Russian, but authoritarian propaganda in general. It doesn't have to be believable.

qwertox2• 5 years ago

It allows to divert a discussion, for example if a Russian politician/minister is confronted with the topic of the Ukraine in a press conference or an interviewer, then it would be easy to stop that discussion by responding with these arrests.

The comparison to the NSA isn't that valid, since it is well known that the NSA does this, but I don't think that there would be many persons who would know a single thing the FSB has done in Cyberspace, unlike them being famous for poisoning and throwing people out of windows.

tigerBL00D• 5 years ago

I don't understand why something like arresting criminals has to be immediately seen as part of some sinister scheme. What's wrong with "cleaning up the cyberspace" being exactly that?

vhgyu75e6u• 5 years ago

Because it is know that Russia looks the other way when dealing with russian ransomware gangs (as long as they don't target Russian business) and it is curiously convinient that it happens now?

weare138• 5 years ago

Or they could just want the money...

Authorities said they seized more than 426 million rubles, $600,000, and €500,000 in cash, along with cryptocurrency wallets, computers, and 20 expensive cars.

lordnacho• 5 years ago

So is is ARE-Evil, or is it REEvil? I've never heard it spoken by anyone, getting my news in written form these days.

3np2• 5 years ago

Neither. It’s REvil.

capableweb6• 5 years ago

Not sure why you're being downvoted, you're right! It's REvil, from "Ransomware Evil", bunch of different sources confirming this, too many to link. But Wikipedia keeps a good list: https://en.wikipedia.org/wiki/REvil

gothroach• 5 years ago

I've heard it said both ways on the news today, but I'm leaning towards R-Evil.

optimalsolver• 5 years ago

r/evil

paulpauper3• 5 years ago

re-evil?

wildzzz• 5 years ago

I keep saying Resident Evil in my head

BTCOG• 5 years ago

It is REE-vil.

ushakov• 5 years ago

seems like low level folks, the real hackers are sitting in moscow city towers

throw7• 5 years ago

"New recruits for GRU. Good." - Putin

openasocket3• 5 years ago

For those wondering if anyone is going to be extradited, they won't be. Under Russian law, a Russian citizen cannot be extradited to another country. As long as these people are Russian citizens they will remain in Russia.

capableweb6• 5 years ago

Who was wondering if they are gonna be extradited? Why would they? Unless they are obviously American (which they obviously aren't), I don't see why anyone would expect or even wonder if they would be extradited.

burrows• 5 years ago

If they extort citizens of some other country, then that other country’s officials will make some attempt to prosecute them in their legal system.

You’re saying this expectation doesn’t match reality?

q1w23• 5 years ago

They're going to get a new job, working for the FSB.

pelasaco2• 5 years ago

The question is: What happens with the whole amount of money seized by FSB?

martythemaniak• 5 years ago

What money?

kingcharles• 5 years ago

I think we can trust the President of Russia...

https://www.youtube.com/watch?v=U0hTrnaa8aE

FpUser2• 5 years ago

Ask PayPal

siva7• 5 years ago

What usually happens: it disappears

tlogan• 5 years ago

I wonder what changed… they definitely did not try to hide. I bet they did something against Putin or refused to do something.

And regarding extradition- if I’m in their shoes I will plead to be extradited to the US.

The higher one is in politburo the deeper one’s grave is.

kgeist5• 5 years ago

There have been precedents, I wrote about it just yesterday: https://news.ycombinator.com/item?id=29913881 Although not as high profile as REvil

capableweb6• 5 years ago

And regarding extradition- if I’m in their shoes I will plead to be extradited to the US.

Where are you from? No one wants to be extradited to the US, not sure why these Russian people would be any different. Just look what happened to Manning. If you want to aim for a fair trial, you don't want to be extradited to the US.

kgeist5• 5 years ago

Here in Russia, prison time is rarely more than 10 years, even for serious crimes like murder. Even terrorists sometimes get just 25 years. In the US on the other hand, it's not uncommon to hear that someone was sentenced to 400 years for some mere fraud. Also, they'd find themselves in a foreign, hostile environment.

Muromec• 5 years ago

Three or four, nobody important, necessarily, average men would do -- (someone at ФСБ few weeks before)

jacquesm• 5 years ago

The FSB plays for keeps, I would not want to be in their shoes. Wonder what they did to piss off the Russian government, it would have to be something like that, as long as they are just ripping off Western Europe and the USA it seems that they were allowed to operate.

bluGill3• 5 years ago

Probably the Russians got tired of US and European diplomats complaining. The squeaky wheel got some grease.

scoopertrooper• 5 years ago

I’d say this might be fig leaf from Russia to America to take some of the heat out of the last week.

londons_explore• 5 years ago

We'll stop those cyberattacks as long as you let us have Ukraine. Deal?

paulpauper3• 5 years ago

nothing will happen to those arrested probably

Trias11• 5 years ago

They missed their regular payment to Putin.

BXLE_1-1-BitIs1• 5 years ago

Likely about the same fate as WWII German Rocket Scientists - Keep doing the same work for a different boss.

birdyrooster2• 5 years ago

I was surprised to see how poorly they lived given how much ransoming had been done. Truly living beneath their means.

ThePadawan• 5 years ago

Maybe they've seen Goodfellas

("oh look, this really poor person rumored to be a criminal suddenly got very very rich and is throwing their money around" is a great way to attract LE attention)

srg0• 5 years ago

I pity the guy who just paid a ransom 5 minutes before the raid. No bitcoins, and no data, and customer service is not available.

FSB arrests REvil ransomware gang members

Related Stories