IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Russia's "politically motivated" REvil raid could be used as leverage, experts warn

The cyber security industry says the FSB's arrests are “unlikely” to signal a change in Russia’s policy

Russia's decision to raid and arrest numerous members of the REvil ransomware group was likely “politically motivated” and could be used by the country used as “leverage”.

That's according to Chris Morgan, a senior cyber threat intelligence analyst at cyber security company Digital Shadows, who told IT Pro that Russia’s Federal Security Service (FSB) “raided REvil knowing that the group were high on the priority list for the US, while considering that their removal would have a small impact on the current ransomware landscape”.

Following the arrests of 14 suspects on Friday, Moscow’s Tverskoi Court has named the eight individuals to be charged as Roman Muromsky, Andrey Bessonov, Golovachuk M.A., Zayets A.N., Khansvyarov R.A., Korotayev D.V., Puzyrevsky D.D., and Malozemov A.V.

The arrests took place a day after the Ukrainian government’s websites were taken down by a cyber attack on Friday, which was unofficially attributed to Russian-aligned threat actors.

“It’s likely that the arrests against REvil members were politically motivated, with Russia looking to use the event as leverage; it could be debated that this may relate to sanctions against Russia recently proposed in the US, or the developing situation on Ukraine's border,” said Morgan. Russia has reportedly deployed around 10,000 troops to the border.

Cybereason chief security officer Sam Curry said that the arrests are “unlikely” to signal a change in Russia’s policy, which in the past has been accused of sponsoring cyber criminals.

“Far more likely is providing a counterpoint to other news on the world stage, to confuse or perhaps even to provide legitimacy to a crackdown on criminals who are “state ignored” (i.e. sanctioned) to keep them in line and playing by the rules domestically,” he told IT Pro.

Curry added that the arrests could lead to less ransomware attacks – for now at least.

Related Resource

Modernise endpoint protection and leave your legacy challenges behind

The risk of keeping your legacy endpoint security tools

Whitepaper front coverDownload now

“The bottom line for those outside Russia is that a major player is taking a hit, which will mean a reduction in victims for the time being. As with most criminal syndicates, though, there’s always another player around to fill the void. And until Russia actually changes domestic policy with regard to International cyber crime, the rest of the world shouldn’t read too much into it,” he said.

However, Morgan believes that the arrests will have a “small impact on the current ransomware landscape”, noting that REvil hadn’t conducted any attacks since October 2021.

“The FSB stated that the arrests were made following 'an appeal' from the US authorities, while the hacking group had in the past targeted American companies including Apple and JBS

“While the specific dialogue between the United States and Russia on this operation are unclear, this statement possibly represents a backhanded message highlighting that Russian authorities can be used to stop ransomware activity, but only under certain circumstances.”

Featured Resources

Activation playbook: Deliver data that powers impactful, game-changing campaigns

Bringing together data and technology to drive better business outcomes

Free Download

In unpredictable times, a data strategy is key

Data processes are crucial to guide decisions and drive business growth

Free Download

Achieving resiliency with Everything-as-a-Service (XAAS)

Transforming the enterprise IT landscape

Free Download

What is contextual analytics?

Creating more customer value in HR software applications

Free Download

Recommended

Mastering endpoint security implementation
Security

Mastering endpoint security implementation

18 May 2022
The Total Economic Impact™ of Apple Mac in Enterprise: M1 update
Whitepaper

The Total Economic Impact™ of Apple Mac in Enterprise: M1 update

12 May 2022
Dell Technologies World 2022: Dell unveils fastest storage architecture in company history
Server & storage

Dell Technologies World 2022: Dell unveils fastest storage architecture in company history

4 May 2022
Dell Technologies World 2022: Dell unveils security offerings for major cloud providers
public cloud

Dell Technologies World 2022: Dell unveils security offerings for major cloud providers

3 May 2022

Most Popular

16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

13 May 2022
(ISC)2 launches free scheme to get 100,000 UK citizens into cyber security
Careers & training

(ISC)2 launches free scheme to get 100,000 UK citizens into cyber security

17 May 2022
Preparing for the 3G sunset
Network & Internet

Preparing for the 3G sunset

18 May 2022