Revil ransomware members released after time served on carding charges

Four REvil ransomware members arrested in January 2022 were released by Russia on time served after they pleaded guilty to carding and malware distribution charges.

As they confirmed, Andrey Bessonov, Mikhail Golovachuk, Roman Muromsky, and Dmitry Korotayev were involved in the Revil gang’s carding activities between October 2015 and January 2022, according to the Russian state-owned news agency TASS.

All four were found guilty by the court and sentenced to five years in prison, but were released from custody because the court considered they had served their sentence in a Russian detention center (SIZO) during the investigation and trial.

The defendants were part of a group of eight members of the REvil ransomware operation apprehended by Russian authorities more than three years ago.

Artem Zayets, Alexey Malozemov, Daniil Puzyrevsky, and Ruslan Khansvyarov, the other REvil members arrested in January 2022, were sentenced to over 4 years in prison as part of a different proceeding after they refused to plead guilty to the charges.

According to Russian news outlet Kommersant, Zayets was sentenced today to 4.5 years, Malozemov to 5 years, Khansvyarov to 5.5 years, and Puzyrevsky to 6 years.

The court found all four of them guilty of illegal circulation of means of payment, while Puzyrevsky and Khansvyarov were also found guilty of distributing malware.

REvil’s downfall

REvil ransomware, also known as Sodin and Sodinokibi, surfaced in April 2019 as a successor to GandCrab, and it became the most prolific ransomware group, demanding high ransom payments and earning over $100 million within a year.

However, in July 2021, things changed when REvil attacked over 1,500 businesses globally in a Kaseya supply chain attack, prompting President Biden to call on President Putin to address cybercriminals in Russia, warning that the U.S. will take action if the Russian government refuses to do so.

Subsequently, the U.S. arrested a REvil ransomware affiliate (Ukrainian national Yaroslav Vasinskyi) responsible for the Kaseya attack in November 2021 and seized over $6 million from another Revil partner (Russian national Yevgeniy Polyanin), suspected of deploying the malware in at least 3,000 ransomware attacks. Vasinskyi was sentenced to 13 years in prison in May 2024 and was ordered to pay $16 million in restitution for his involvement in REvil ransomware attacks.

The same month, Romanian authorities arrested two other REvil ransomware affiliates linked to thousands of other REvil attacks.

After the Kaseya attack, and likely prompted by the law enforcement pressure, the REvil gang took a break but resumed operations two months later. However, they unknowingly also restored machines controlled by law enforcement after the authorities breached their servers right before REvil decided to pause their operations.

This led to another wave of arrests, with the Russian Federal Security Service (FSB) apprehending 14 suspects linked to the REvil ransomware-as-a-service (RaaS) operation in January 2022 and saying it identified all members of the REvil gang and documented their illegal activities.

“As a result of the joint actions of the FSB and the Ministry of Internal Affairs of Russia, the organized criminal community ceased to exist, the information infrastructure used for criminal purposes was neutralized,” the FSB said.

However, after it invaded Ukraine, Russia said in April 2022 that the U.S. had unilaterally shut down communication channels with Russia on cybersecurity and withdrawn the negotiation process regarding the REvil gang.

Patching used to mean complex scripts, long hours, and endless fire drills. Not anymore.

In this new guide, Tines breaks down how modern IT orgs are leveling up with automation. Patch faster, reduce overhead, and focus on strategic work — no complex scripts required.

Source link