{"id":503,"date":"2022-01-17T22:28:24","date_gmt":"2022-01-18T05:28:24","guid":{"rendered":"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/?p=503"},"modified":"2022-01-17T22:37:05","modified_gmt":"2022-01-18T05:37:05","slug":"revil-ransomware-gang-arrested-in-russia","status":"publish","type":"post","link":"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/2022\/01\/17\/revil-ransomware-gang-arrested-in-russia\/","title":{"rendered":"REvil Ransomware Gang Arrested in Russia"},"content":{"rendered":"\n
\"\"
Photo showing a wanted poster of hacker Yevgyeniy Igoryevitch Polyanin (photo courtesy of Andrew Harnik\/AP)<\/figcaption><\/figure><\/div>\n\n\n\n

Last Friday, 14 members of a ransomware group known as REvil were arrested by Russian authorities at the request of the United States[1]<\/sup>. Of those arrested, one individual has been attributed as having been partially responsible for the Colonial Pipeline attack in May of 2021[2]<\/sup>. REvil as an organization has executed numerous cyberattacks since their inception in 2019[3]<\/sup>, among those being attacks on American software company Kaseya[4]<\/sup> and Brazil-based meat processing company JBS[5]<\/sup>. This is the first major case in which Russia has cracked down on domestic cyberthreats to international organizations.<\/p>\n\n\n\n

These arrests are very impactful both in terms of security and in politics. These arrests likely mean that there will be fewer attacks from this group, and those that do occur may not be as severe as those they conducted in the past. In addition to that, this sets a precedent for cooperation between the United States and Russia for action against cybersecurity threats in the future. Whether or not this kind of diplomatic relationship can or will be maintained is something we will have to observe over the coming months and\/or years.<\/p>\n\n\n\n

Although the arrests are big news, it is unlikely that this is the end of REvil’s attacks. Russian authorities have suggested that all (or at least most) of those arrested are not the masterminds behind the attacks, but rather underlings[6]<\/sup>. Even if REvil is to be disbanded, those primarily behind the organization’s attacks will likely gather under a new (or perhaps even the same) name and continue their pursuits. We will have to see if Russian authorities continue to track down and arrest members of REvil, or if they will drop the case and consider it settled (at least for now).<\/p>\n\n\n\n

This series of arrests comes at a time where political tensions are rising between Russia, Ukraine, and the United States as the Ukrainian border has become increasingly populated by Russian military forces (possibly as preparation for an invasion). It appears to be the only fruitful agreement between Russia and the U.S. as other talks about peace for Ukraine have failed[7]<\/sup>. It is possible that the Russian government’s cooperation in this case may be related to these events.<\/p>\n\n\n\n

The action of the Russian government in dealing with this domestic hacker group has spawned some interesting discussion and gives us something in the cybersecurity space to observe as time passes. Whether cooperation between the United States and Russia continue, conflicts of interest occur (as they often do), or further events bring more information to light, there’s a lot to keep an eye on.<\/p>\n\n\n\n