Two massive ransomware attacks throttled vulnerable U.S. companies last month.
The May 7 hit on caused a week of havoc and gas lines until the company coughed up $2.3 million in cryptocurrency. Three weeks later, the meat producer was paralyzed after hackers hit computer servers in Brazil, the U.S., Australia and Canada.
After U.S. intelligence blamed two Russian-speaking cybergangs, and , Russian President Vladimir Putin was asked about the ransomware attacks on state TV.
“I’ve heard about some kind of a meat factory. Well, that is nonsense, simply ridiculous. The pipeline [attack] is ridiculous too, like the shareholder or the shareholders of the company that owns this pipeline system even paid money to the extortionists. Well, it’s just nonsense to blame Russia for this.”
Putin’s claim is misleading.
Plenty of not-ridiculous history has demonstrated Russia’s tolerance for hackers, not to mention the country’s alleged interference in U.S. elections with online disinformation and hacking. Then there is last year’s , which compromised .
A recent by a task force of experts from tech firms, government and law enforcement said that in 2020, nearly 2,400 U.S. government, health care facilities, schools and businesses were hit with ransomware attacks and paid out $350 million, a 300 percent increase over the prior year.
“Ransomware is no longer just a financial crime; it is an urgent national security risk that threatens schools, hospitals, businesses, and governments across the globe,” the report said, while making recommendations for a public-private partnership to fight the problem.
Testifying before the U.S. House of Representatives’ Judiciary Committee on June 10, said that “[t]he Russians have a very-active clearly state-sponsored cyber campaign.” He also said his agency had identified and indicted members of the Russian military and foreign intelligence services in multiple attacks against the U.S. Apart from the intelligence operatives, there are “quite a number of cyber-criminal actors operating on Russian soil," Wray said.
“The degree of nexus between those cyber criminals and the Russian government is not something I can discuss in an open hearing,” Wray added.
REvil and are relatively new Russian-speaking groups that break into computers, then encrypt and block the victims’ access to their own data.
According to analysts at , and other cybersecurity firms, REvil and DarkSide surfaced in 2019 and 2020 and have claimed of up to $100 million.
Brian Krebs, a former Washington Post reporter and now cybersecurity blogger, DarkSide’s modus operandi after the pipeline hack:
and reported observing evidence of a partnership between the DarkSide and REvil, and noted similarities in their tactics and structure, suggesting that both could be run by the same operator or by an alliance.
These networks via a structure known as Ransomware-as-a-service (RaaS), based on deals between malware (software) developers and distributors (hackers). If an attack is successful, developers get 20% to 30% and the hackers get the rest.
REvil and DarkSide took responsibility for the attacks, bragging about their success publicly in internet forums that are now closed.
The same day as Putin’s remarks, an anonymous person nicknamed UNKN (Unknown) commented on behalf of REvil about the attack on JBS in an interview with a popular vlogger with the screen name @Russian_OSINT. The exchange was .
Some media, including and several cyber security web sites, cited the interview, referring to the “representative” either as authentic or alleged. The information technology website described “Unknown” as a “public-facing representative of REvil” who communicates with the outside world via web forums and chats.
The cyber website summarized an earlier interview in English, also describing the person behind it as an “alleged” representative of REvil.
Asked about his communications with the REvil contact, @Russian_OSINT told Polygraph.info that he "can’t say it’s a 100% their representative. I’ve posted my questions in the forum they control, they posted their answers.”
Sergey Golovanov, chief security expert at the Russian antivirus company Kaspersky Lab, embraced @Russian_OSINT as a trustworthy and reliable source. He also shared REvil interviews on Twitter.
In one, the purported REvil representative complained that the group is “being dragged into politics” by the United States, which “put us on the agenda of the discussion with (Vladimir) Putin,” a reference to an upcoming meeting between U.S. President Joe Biden and the Russian leader in Geneva.