Governments turn tables on ransomware gang REvil by pushing it offline

1 / 2
US officials talk about the Colonial Pipeline ransomware attack during a news conference in Washington, D.C. on June 7, 2021. (REUTERS/File Photo)
Short Url
Updated 22 October 2021
Follow

Governments turn tables on ransomware gang REvil by pushing it offline

  • Law enforcement and intelligence cyber specialists were able to hack REvil's computer network infrastructure, obtaining control of at least some of their servers
  • One person familiar with the events said that a foreign partner of the US government carried out the hacking operation that penetrated REvil's computer architecture

The ransomware group REvil was itself hacked and forced offline this week by a multi-country operation, according to three private sector cyber experts working with the United States and one former official.
Former partners and associates of the Russian-led criminal gang were responsible for a May cyberattack on the Colonial Pipeline that led to widespread gas shortages on the US East Coast. REvil's direct victims include top meatpacker JBS. The crime group's "Happy Blog” website, which had been used to leak victim data and extort companies, is no longer available.
Officials said the Colonial attack used encryption software called DarkSide, which was developed by REvil associates.
VMWare head of cybersecurity strategy Tom Kellermann said law enforcement and intelligence personnel stopped the group from victimizing additional companies.
"The FBI, in conjunction with Cyber Command, the Secret Service and like-minded countries, have truly engaged in significant disruptive actions against these groups,” said Kellermann, an adviser to the US Secret Service on cybercrime investigations. “REvil was top of the list.”
A leadership figure known as "0_neday," who had helped restart the group's operations after an earlier shutdown, said REvil's servers had been hacked by an unnamed party.
"The server was compromised, and they were looking for me," 0_neday wrote on a cybercrime forum last weekend and first spotted by security firm Recorded Future. "Good luck, everyone; I'm off."
US government attempts to stop REvil, one of the worst of dozens of ransomware gangs that work with hackers to penetrate and paralyze companies around the world, accelerated after the group compromised US software management company Kaseya in July. 
That breach opened access to hundreds of Kaseya's customers all at once, leading to numerous emergency cyber incident response calls.

Decryption key
Following the attack on Kaseya, the FBI obtained a universal decryption key that allowed those infected via Kaseya to recover their files without paying a ransom.
But law enforcement officials initially withheld the key for weeks as it quietly pursued REvil's staff, the FBI later acknowledged. 
According to three people familiar with the matter, law enforcement and intelligence cyber specialists were able to hack REvil's computer network infrastructure, obtaining control of at least some of their servers.
After websites that the hacker group used to conduct business went offline in July, the main spokesman for the group, who calls himself "Unknown," vanished from the internet.
When gang member 0_neday and others restored those websites from a backup last month, he unknowingly restarted some internal systems that were already controlled by law enforcement.
“The REvil ransomware gang restored the infrastructure from the backups under the assumption that they had not been compromised,” said Oleg Skulkin, deputy head of the forensics lab at the Russian-led security company Group-IB. “Ironically, the gang's own favorite tactic of compromising the backups was turned against them.”
Reliable backups are one of the most important defenses against ransomware attacks, but they must be kept unconnected from the main networks or they too can be encrypted by extortionists such as REvil.
A spokesperson for the White House National Security Council declined to comment on the operation specifically.
"Broadly speaking, we are undertaking a whole of government ransomware effort, including disruption of ransomware infrastructure and actors, working with the private sector to modernize our defenses, and building an international coalition to hold countries who harbor ransom actors accountable," the person said.
The FBI declined to comment.
One person familiar with the events said that a foreign partner of the US government carried out the hacking operation that penetrated REvil's computer architecture. A former US official, who spoke on condition of anonymity, said the operation is still active.
The success stems from a determination by US Deputy Attorney General Lisa Monaco that ransomware attacks on critical infrastructure should be treated as a national security issue akin to terrorism, Kellermann said.
In June, Principal Associate Deputy Attorney General John Carlin told Reuters the Justice Department was elevating investigations of ransomware attacks to a similar priority.
Such actions gave the Justice Department and other agencies a legal basis to get help from US intelligence agencies and the Department of Defense, Kellermann said.
"Before, you couldn't hack into these forums, and the military didn't want to have anything to do with it. Since then, the gloves have come off." 


Judge suspends the dismantling of US Education Department

Updated 9 sec ago
Follow

Judge suspends the dismantling of US Education Department

WASHINGTON:  A US federal judge on Thursday suspended President Donald Trump’s executive order that effectively eliminates the country’s Education Department and ordered the reinstatement of hundreds of fired employees.
In March, the department announced that it was slashing staff numbers by nearly half, shortly after Trump issued an executive order instructing Education Secretary Linda McMahon to “put herself out of a job.”
That move was hailed by Trump’s supporters on the right, but by law, the department created in 1979 cannot be shuttered without the approval of Congress.
Around 20 states, along with teachers’ unions have challenged the decisions in court, arguing that the government is violating the principle of separation of powers by encroaching on Congress’s prerogatives.
A federal judge in the northeastern city of Boston agreed with the plaintiffs, suspending the executive order and ordering the reinstatement of hundreds of dismissed employees.
“This court cannot be asked to cover its eyes while the Department’s employees are continuously fired and units are transferred out until the Department becomes a shell of itself,” Judge Myong Joun said in his ruling.
Traditionally, the federal government has had a limited role in education in the United States, with only about 13 percent of funding for primary and secondary schools coming from federal coffers, the rest being funded by states and local communities.
But federal funding is invaluable for low-income schools and students with special needs. And the federal government has been essential in enforcing key civil rights protections for students.
The Education Department cannot be completely dismantled without Congress’s approval, including 60 votes in the Senate where the ruling Republicans currently hold 53 seats.


G7 to ‘maximize pressure’ on Russia if it resists Ukraine ceasefire

Updated 22 May 2025
Follow

G7 to ‘maximize pressure’ on Russia if it resists Ukraine ceasefire

  • Diplomatic efforts to end the conflict have stepped up in recent weeks
  • The Kremlin said Thursday that new peace talks with Ukraine had “yet to be agreed“

BANFF, Canada: G7 finance ministers agreed Thursday to “maximize pressure” on Russia, including through further sanctions, if it resists efforts toward a ceasefire in Ukraine.

“If such a ceasefire is not agreed, we will continue to explore all possible options, including options to maximize pressure such as further ramping up sanctions,” a final communique following the group’s meeting in Canada said.

Diplomatic efforts to end the conflict have stepped up in recent weeks, with Russian and Ukrainian officials holding their first face-to-face talks in more than three years last week in Istanbul.

But the Kremlin said Thursday that new peace talks with Ukraine had “yet to be agreed,” disputing reports the two nations would soon hold negotiations at the Vatican.

US President Donald Trump spoke with Russian counterpart Vladimir Putin on Monday in a call aimed at ending the “bloodbath,” but neither his contact nor the earlier talks in Istanbul resulted in Russia offering any concessions.

The communique from the Group of Seven advanced economies condemned “Russia’s continued brutal war against Ukraine” and said any entity that supported Russia during the conflict would be barred from Ukrainian reconstruction contracts.

“We agree to work together with Ukraine to ensure that no countries or entities, or entities from those countries that financed or supplied the Russian war machine will be eligible to profit from Ukraine’s reconstruction,” it said.


Federal judge blocks immigration authorities from revoking international students’ legal status

Updated 22 May 2025
Follow

Federal judge blocks immigration authorities from revoking international students’ legal status

  • Students could still be arrested for other reasons and their legal status can still be revoked
  • Most courts hearing these types of cases have granted protections to the person suing

SAN FRANCISCO: A judge in California blocked the Trump administration Thursday from terminating the legal status of international students nationwide while a court case challenging previous terminations is pending.

The order by US District Judge Jeffrey S. White in Oakland bars the government from arresting, incarcerating or moving students elsewhere based on their legal status until the case is resolved.

Students could still be arrested for other reasons and their legal status can still be revoked if they are convicted of a violent crime carrying a prison term of more than a year.

Most courts hearing these types of cases have granted protections to the person suing, but White said the government’s actions “wreaked havoc” not only on the lives of plaintiffs but other nonimmigrants in the US on student visas.

White, who was nominated by President George W. Bush, a Republican, issued the nationwide injunction sought by attorneys for about two dozen students who sued after their legal status was abruptly terminated in early April by Immigration and Customs Enforcement.

More than 4,700 international students had their permission to study in the US canceled this spring, with little notice or explanation, as part of President Donald Trump’s crackdown on immigrants and foreign nationals. In court hearings, Department of Homeland Security officials said they ran the names of student visa holders through an FBI-run database that contains the names of suspects and people who have been arrested, even if the charges were dropped or they were never charged with a crime.

Some students left the US rather than risk being deported to a third country.

Government lawyers say the administration is exercising its prerogative to administer the Immigration and Nationality Act. They say students do not need the court’s protections because ICE reinstated legal status and was mailing status reactivation letters to affected students.

But White found those actions insufficient. He said that the erroneous revocation remained in the students’ record, impacting their ability to obtain a new visa or change their nonimmigrant status. Some students are still dealing with fallout from the previous terminations and there is no guarantee they won’t have their legal status revoked again on a whim.

He also chastised the administration for unveiling new policies or new actions in an apparent attempt to satisfy the courts’ concerns.

“It is unclear how this game of whack-a-mole will end unless Defendants are enjoined from skirting their own mandatory regulations,” White wrote.

A survey by The Associated Press-NORC Center for Public Affairs research found that even the visa revocations for students who participated in pro-Palestinian protests are more unpopular than popular. About half of US adults oppose this policy, and only 3 in 10 are in support.

Among college educated adults, 6 in 10 strongly oppose, compared with 4 in 10 who aren’t college graduates.


Panama resumes flights to Venezuela, allowing for migrant returns

Updated 22 May 2025
Follow

Panama resumes flights to Venezuela, allowing for migrant returns

  • Venezuela suspended air links with Panama in July 2024
  • The resumption of flights is expected to facilitate the repatriation from Panama of Venezuelan migrants deported from the US

PANAMA CITY: Panama’s civil aviation authority on Thursday announced that it would resume flights with Venezuela after nearly a year, facilitating the repatriation of Venezuelan migrants expelled from the United States.

Venezuela suspended air links with Panama in July 2024 over its refusal to recognize Venezuelan President Nicolas Maduro’s victory in presidential elections.

The two countries at the time also suspended diplomatic relations.

The resumption of flights is expected to facilitate the repatriation from Panama of Venezuelan migrants deported from the United States.

Panamanian President Jose Raul Mulino said earlier he had received a proposal from Caracas to resume flights between the two countries.

“I will evaluate it very carefully right away,” he told his weekly press conference, adding “it is in Panama’s best interest to open commercial flights to Venezuela.”

Mulino however ruled out restoring diplomatic relations with the Caribbean nation.

Panama is one of a handful of countries that has agreed to act as a stopover for migrants expelled from the United States by President Donald Trump’s administration.

Under the plan, Panama holds the migrants in closed shelters while waiting for them to be repatriated to their homelands.

Many of those expelled so far have been from Venezuela and other South American countries.

Panama has also been grappling with a reverse flow of thousands of migrants returning home through Central America after failing to gain entry to the Untied States.

In the absence of flights between Panama and Venezuela, many of the migrants were left to organize their own transport home, either by boat or overland through the treacherous Darien jungle on Panama’s border with Colombia.


Homeland Security blocking Harvard’s ability to enroll international students

Updated 22 May 2025
Follow

Homeland Security blocking Harvard’s ability to enroll international students

  • Kristi Noem: ‘This administration is holding Harvard accountable for fostering violence, antisemitism, and coordinating with the Chinese Communist Party on its campus’
  • Harvard: ‘We are fully committed to maintaining Harvard’s ability to host international students and scholars, who hail from more than 140 countries and enrich the University’

US President Donald Trump’s administration has revoked Harvard University’s ability to enroll international students, and will force existing students to transfer to other schools or lose their legal status, the Department of Homeland Security said on Thursday.

Homeland Security Secretary Kristi Noem ordered the department to terminate Harvard University’s Student and Exchange Visitor Program (SEVP) certification, the department said in a statement.

Harvard called the action illegal.

The move comes after Harvard refused to provide information Noem had previously demanded about some foreign student visa holders who attend the university, the department said.

“This administration is holding Harvard accountable for fostering violence, antisemitism, and coordinating with the Chinese Communist Party on its campus,” Noem said.

“It is a privilege, not a right, for universities to enroll foreign students and benefit from their higher tuition payments to help pad their multibillion-dollar endowments.”

Harvard said the move a retaliatory action that threatens serious harm to the university.

“The government’s action is unlawful. We are fully committed to maintaining Harvard’s ability to host international students and scholars, who hail from more than 140 countries and enrich the University – and this nation – immeasurably,” the university said in a statement.

The White House did not immediately respond to requests for comment.

The move marks a significant escalation of the Trump administration’s campaign against the elite Ivy League university in Cambridge, Massachusetts, which has emerged as one of Trump’s most prominent institutional targets.

The Republican president has undertaken an extraordinary effort to revamp private colleges and schools across the US that he says foster anti-American, Marxist and “radical left” ideologies.

He has criticized Harvard in particular for hiring prominent Democrats to teaching or leadership positions.