Governments turn tables on ransomware gang REvil by pushing it offline

1 / 2
US officials talk about the Colonial Pipeline ransomware attack during a news conference in Washington, D.C. on June 7, 2021. (REUTERS/File Photo)
2 / 2
Short Url
Updated 22 October 2021
Follow

Governments turn tables on ransomware gang REvil by pushing it offline

  • Law enforcement and intelligence cyber specialists were able to hack REvil's computer network infrastructure, obtaining control of at least some of their servers
  • One person familiar with the events said that a foreign partner of the US government carried out the hacking operation that penetrated REvil's computer architecture

The ransomware group REvil was itself hacked and forced offline this week by a multi-country operation, according to three private sector cyber experts working with the United States and one former official.
Former partners and associates of the Russian-led criminal gang were responsible for a May cyberattack on the Colonial Pipeline that led to widespread gas shortages on the US East Coast. REvil's direct victims include top meatpacker JBS. The crime group's "Happy Blog” website, which had been used to leak victim data and extort companies, is no longer available.
Officials said the Colonial attack used encryption software called DarkSide, which was developed by REvil associates.
VMWare head of cybersecurity strategy Tom Kellermann said law enforcement and intelligence personnel stopped the group from victimizing additional companies.
"The FBI, in conjunction with Cyber Command, the Secret Service and like-minded countries, have truly engaged in significant disruptive actions against these groups,” said Kellermann, an adviser to the US Secret Service on cybercrime investigations. “REvil was top of the list.”
A leadership figure known as "0_neday," who had helped restart the group's operations after an earlier shutdown, said REvil's servers had been hacked by an unnamed party.
"The server was compromised, and they were looking for me," 0_neday wrote on a cybercrime forum last weekend and first spotted by security firm Recorded Future. "Good luck, everyone; I'm off."
US government attempts to stop REvil, one of the worst of dozens of ransomware gangs that work with hackers to penetrate and paralyze companies around the world, accelerated after the group compromised US software management company Kaseya in July. 
That breach opened access to hundreds of Kaseya's customers all at once, leading to numerous emergency cyber incident response calls.

Decryption key
Following the attack on Kaseya, the FBI obtained a universal decryption key that allowed those infected via Kaseya to recover their files without paying a ransom.
But law enforcement officials initially withheld the key for weeks as it quietly pursued REvil's staff, the FBI later acknowledged. 
According to three people familiar with the matter, law enforcement and intelligence cyber specialists were able to hack REvil's computer network infrastructure, obtaining control of at least some of their servers.
After websites that the hacker group used to conduct business went offline in July, the main spokesman for the group, who calls himself "Unknown," vanished from the internet.
When gang member 0_neday and others restored those websites from a backup last month, he unknowingly restarted some internal systems that were already controlled by law enforcement.
“The REvil ransomware gang restored the infrastructure from the backups under the assumption that they had not been compromised,” said Oleg Skulkin, deputy head of the forensics lab at the Russian-led security company Group-IB. “Ironically, the gang's own favorite tactic of compromising the backups was turned against them.”
Reliable backups are one of the most important defenses against ransomware attacks, but they must be kept unconnected from the main networks or they too can be encrypted by extortionists such as REvil.
A spokesperson for the White House National Security Council declined to comment on the operation specifically.
"Broadly speaking, we are undertaking a whole of government ransomware effort, including disruption of ransomware infrastructure and actors, working with the private sector to modernize our defenses, and building an international coalition to hold countries who harbor ransom actors accountable," the person said.
The FBI declined to comment.
One person familiar with the events said that a foreign partner of the US government carried out the hacking operation that penetrated REvil's computer architecture. A former US official, who spoke on condition of anonymity, said the operation is still active.
The success stems from a determination by US Deputy Attorney General Lisa Monaco that ransomware attacks on critical infrastructure should be treated as a national security issue akin to terrorism, Kellermann said.
In June, Principal Associate Deputy Attorney General John Carlin told Reuters the Justice Department was elevating investigations of ransomware attacks to a similar priority.
Such actions gave the Justice Department and other agencies a legal basis to get help from US intelligence agencies and the Department of Defense, Kellermann said.
"Before, you couldn't hack into these forums, and the military didn't want to have anything to do with it. Since then, the gloves have come off." 


UN food agency says to halt aid for 650,000 women, children in Ethiopia

Updated 18 sec ago
Follow

UN food agency says to halt aid for 650,000 women, children in Ethiopia

ADDIS ABABA: The World Food Programme said Tuesday that it was suspending aid for 650,000 malnourished women and children in Ethiopia due to a lack of funding.
“WFP is being forced to halt treatment for 650,000 malnourished women and children in May due to insufficient funding. WFP had planned to reach two million mothers and children with life-saving nutrition assistance in 2025,” the UN agency said in a statement.


Cardinals set Pope Francis’ funeral for Saturday morning, with public viewing starting Wednesday

Updated 32 min 1 sec ago
Follow

Cardinals set Pope Francis’ funeral for Saturday morning, with public viewing starting Wednesday

  • First so-called ‘general congregation’ signals the start of a centuries-old tradition that culminates in the election by cardinals of a new pontiff within three weeks

VATICAN CITY: Cardinals have taken their first decisions following the death of Pope Francis, setting Saturday as the date for his funeral and allowing ordinary faithful to begin paying their final respects starting Wednesday, when his casket is brought into St. Peter’s Basilica.

The cardinals met for the first time Tuesday in the Vatican’s synod hall to chart the next steps before a conclave begins to choose Francis’ successor, as condolences poured in from around the world grieving history’s first Latin American pope.

The cardinals set the funeral for Saturday at 10 a.m. in St. Peter’s Square, to be celebrated by the dean of the College of Cardinals, Cardinal Giovanni Battista Re.

US President Donald Trump has announced he and first lady Melania Trump plan to attend Saturday’s funeral Argentine President Javier Milei is also expected.

Francis died Monday at age 88 after suffering a stroke that put him in a coma and led his heart to fail. He had been recovering in his apartment after being hospitalized for five weeks with pneumonia. He made his last public appearance Sunday, delivering an Easter blessing and making what would be his final greeting to followers from his popemobile, looping around St. Peter’s Square.

In retrospect, his Easter appearance from the same loggia where he was introduced to the world as the first pope from the Americas on March 13, 2013, was a perfect bookend to a 12-year papacy that sought to shake up the church and return it to its Gospel-mandated mission of caring for the poorest.

“He gave himself to the end,” said Cardinal Matteo Zuppi, the head of the Italian bishops’ conference and considered a possible contender to be next pope. “To go out to meet everyone, speak to everyone, teach us to speak to everyone, to bless everyone.”

The first images of Francis’ body were released Tuesday, showing him in the wooden casket, in red vestments and his bishop’s miter, with the Vatican secretary of state praying over him in the chapel of the Domus Santa Marta hotel where he lived and died.

In his final will, Francis confirmed he would be buried at St. Mary Major basilica, which is outside the Vatican and home to his favorite icon of the Virgin Mary. Before and after every foreign trip, Francis would go to the basilica to pray before the Byzantine-style painting that features an image of Mary, draped in a blue robe, holding the infant Jesus, who in turn holds a jeweled golden book.

Francis stopped by the basilica on his way home from the Gemelli hospital on March 23, after his 38-day hospital stay, to deliver flowers to be placed before the icon. He returned April 12 to pray before the Madonna for the last time.

The world reacts

Bells tolled in chapels, churches and cathedrals around the world and flags flew at half staff in Italy, India, Taiwan and the US after Francis’ death was announced by the Vatican camerlengo. Soccer matches in Italy and Argentina were suspended in honor of the Argentine pope who was a lifelong fan of the San Lorenzo soccer club.

World leaders praised Francis for his moral leadership and compassion, while ordinary faithful remembered his simplicity and humanity.

“Like every Argentine, I think he was a rebel,” said 23-year-old Catalina Favaro, who had come to pay her respects in the Buenos Aires church where Francis discovered his priestly vocation. “He may have been contradictory, but that was nice, too.”

In East Timor, where Francis’ final outdoor Mass drew nearly half of the population last September, President Jose Ramos-Horta praised Francis’ courage. “Papa Francisco was a brave man who was not afraid to speak out against the rulers of the world who seek war, but do not want to seek peace,” Ramos-Horta said.

“He challenged the powerful to act with justice, called nations to welcome the stranger, and reminded us that our common home – this Earth – is a gift we must protect for future generations,” said Nigeria’s President Bola Tinubu, who is Muslim. Nigeria is Africa’s most populous country and has around 30 million Catholics, representing about 14 percent of the total population.

Viewing the pope’s coffin

The pope’s formal apartments in the Apostolic Palace and in the Santa Marta hotel were sealed Monday evening, following a centuries-old ritual. Cardinal Kevin Farrell, who as camerlengo had the task of announcing the death and confirming it once the cause was determined, presided over the rituals.

Francis chose not to live in the palace, though, but in a two-room suite in Santa Marta on the other side of Vatican City. He died there and his body was transferred to the hotel chapel in the lobby, where the private viewing was being held Tuesday for Vatican officials and members of the pontifical household.

In changes made by Francis last year, his body was not placed in three wooden coffins, as it had been for previous popes. Rather, Francis was placed in a simplified wooden coffin with a zinc coffin inside.

Once in St. Peter’s, his coffin will not be put on an elevated bier but will just be placed simply facing the pews, with the Paschal candle nearby.

“He was a pope who didn’t change his path when it came to getting dirty,” Francis’ vicar for Rome, Cardinal Baldassarre Reina, said in a Mass in his honor. “For him, poor people and migrants were the sacrament of Jesus.”

Choosing the next pope

After the funeral, there are nine days of official mourning, known as the “novendiali.” During this period, cardinals arrive in Rome and meet privately before the conclave.

To give everyone time to assemble, the conclave must begin 15-20 days after the “sede vacante” – the “vacant See” – is declared, although it can start sooner if the cardinals agree.

Once the conclave begins, cardinals vote in secret sessions in the Sistine Chapel. After voting sessions, the ballots are burned in a special stove. Black smoke indicates that no pope has been elected, while white smoke indicates that the cardinals have chosen the next head of the Catholic Church.

The one who has secured two-thirds of the votes wins. If he accepts, his election is announced by a cardinal from the loggia of St. Peter’s Basilica who tells the world “Habemus Papam,” Latin for “We have a pope.”


France’s Barrot: Europeans expressed red lines over Ukraine to US

Updated 22 April 2025
Follow

France’s Barrot: Europeans expressed red lines over Ukraine to US

  • Barrot says Putin’s truce in Ukraine over Easter was a marketing operating operation aimed at preventing that US President Donald Trump gets impatient

PARIS: Europe has expressed its red lines over Ukraine to the United States at a meeting last week ahead of a new round of discussions in London on Wednesday, French Foreign Minister Jean-Noel Barrot said on Tuesday.
He also said in an interview with francinfo radio that Russian President Vladimir Putin’s truce in Ukraine over Easter was a marketing operating operation aimed at preventing that US President Donald Trump gets impatient with him.

“The Easter truce that he announced somewhat unexpectedly was a marketing operation, a charm operation aimed at preventing President Trump from becoming impatient and angry,” Barrot told the FranceInfo broadcaster, a day after Russia launched aerial attacks on Ukraine in an abrupt end to the fragile Easter truce.


Australians start voting in general elections as pope’s death overshadows campaigning

Updated 22 April 2025
Follow

Australians start voting in general elections as pope’s death overshadows campaigning

  • Polling stations opened to voters who, for a variety of reasons, will be unable to vote on May 3
  • Around half the votes are expected to be cast before the election date

MELBOURNE: Australians began voting Tuesday at general elections as the death of Pope Francis overshadowed campaigning.
Polling stations opened to voters who, for a variety of reasons, will be unable to vote on May 3. Around half the votes are expected to be cast before the election date.
Both Prime Minister Anthony Albanese and opposition leader Peter Dutton canceled campaign events planned for Tuesday out of respect for the late pontiff.
Flags were flown at half staff from government buildings across the country, where a 2021 census found 20 percent of the population were Catholics.
Albanese was raised as a Catholic but chose to be sworn in as prime minister when elected in 2022 by making a secular affirmation rather than by taking an oath on a Bible.
Albanese, who has described himself as a “flawed Catholic,” attended a Mass in honor of the pope in Melbourne’s St. Patrick’s Cathedral on Tuesday morning.
“I try not to talk about my faith in public,” Albanese said.
“At times like this, I think what people do is they draw on who they are and certainly my Catholicism is just a part of me,” he added.
Albanese and Dutton, who leads the conservative Liberal Party, will meet in Sydney later Tuesday for the third televised leaders’ debate of the campaign.
A fourth debate is planned Sunday.
Dutton, who was raised by a Catholic father and Protestant mother and attended an Anglican school, attended a Mass on Tuesday afternoon at Sydney’s St. Mary’s Cathedral.
“I don’t think it’s a day for overt politicking at all. I think that the day is best spent reflecting,” Dutton said.
“I don’t think there’s a place for the body blows of politics today. I think it’s a very different day from that,” Dutton added.
Albanese’s center-left Labour Party is seeking a second three-year term.
The government held a narrow majority of 78 seats out of 151 in the House of Representatives, where parties form administrations during their first term.
The lower chamber will shrink to 150 seats after the election due to redistributions.
The major parties are both predicting a close election result.


Taiwan cabinet to ask parliament to unfreeze $4bn amid budget standoff

Updated 22 April 2025
Follow

Taiwan cabinet to ask parliament to unfreeze $4bn amid budget standoff

  • Cabinet spokesperson Michelle Lee says the government will ask parliament to unfreeze T$138.1 billion ($4.25 billion) in funds
  • Cabinet will also seek a legal interpretation from the constitutional court on both the constitutionality of the budget as passed by lawmakers

TAIPEI: Taiwan’s cabinet said on Tuesday it will ask the opposition controlled legislature to release more than $4 billion in funds frozen as part of a stand-off over this year’s budget, which the government says could seriously affect their operations.
While the Democratic Progressive Party’s (DPP) Lai Ching-te won the presidency in last year’s elections, the party lost its majority in parliament.
Taiwan’s main opposition party, the Kuomintang (KMT), along with the small Taiwan People’s Party (TPP), control the most seats, and earlier this year voted through sweeping cuts to 2025’s budget, saying they were targeting waste, and froze other funds saying they wanted greater oversight on spending plans.
In a statement, cabinet spokesperson Michelle Lee said the government will ask parliament to unfreeze T$138.1 billion ($4.25 billion) in funds.
The cabinet “hopes the Legislative Yuan can unfreeze it all in a short period of time to reduce the difficulties and inconveniences people have in their dealings with the administration,” Lee said, using parliament’s formal name.
The cabinet will also seek a legal interpretation from the constitutional court on both the constitutionality of the budget as passed by lawmakers, and a separate legal amendment granting more money to local governments at the expense of the central government, Lee added.
The defense ministry has warned of a “serious impact” to security from the amended budget, saying it will require a cut in defense spending of some T$80 billion at a time when the island is facing an elevated Chinese military threat.
Taiwan’s opposition has shown little appetite to seek compromise with the government on the budget issue, given they are angered at a campaign led by civic groups and backed by senior DPP officials to recall a swathe of opposition lawmakers.
The KMT and TPP chairmen met earlier on Tuesday vowing to redouble efforts to work together against the “green communists,” referring to the DPP’s party colors, and will hold a joint protest in front of the presidential office on Saturday.
“We don’t just want to take down Lai Ching-te, but the entire corrupt, arrogant and abusive system,” KMT Chairman Eric Chu wrote on his Facebook page after meeting TPP Chairman Huang Kuo-chang.
Lai and the DPP’s public approval ratings have remained relatively high.
A poll last week by Taiwan television station Mirror TV put the DPP’s approval rating at 45 percent, relatively steady over the past year, with both the KMT and TPP on around 28 percent, both down compared with the year ago period.