Full Report
Four convicted members of the REvil cybercrime gang were released from custody after being sentenced in St. Petersburg for offenses related to payment card fraud.
Analysis Summary
# Threat Actor: REvil Ransomware Gang (Activity related to internal financial/carding fraud charges in Russia)
## Attribution & Identity
- **Attribution Context:** Members of this group were arrested and prosecuted by Russian authorities (FSB).
- **Known Aliases and associated groups:** REvil (also known as Sodinokibi). The article focuses on members prosecuted for carding fraud, potentially distinct from their high-profile ransomware operations, although they are members of the same syndicate.
## Activity Summary
The summary details the sentencing of four members (Andrei Bessonov, Mikhail Golovachuk, Roman Muromsky, and Dmitry Korotaev) by a Russian court for trafficking stolen payment data and carding fraud, not for their notorious ransomware activities. The crackdown followed calls between US President Biden and President Putin concerning cybercrime disrupting American interests. Other members were previously sentenced for related financial crimes. REvil was previously one of the most active ransomware gangs before its shutdown in 2021.
## Tactics, Techniques & Procedures
- Trafficking stolen payment data.
- Using malicious software to commit carding fraud.
- [Historical/High-Profile TTPs]: Deploying ransomware via compromised software supply chain (e.g., Kaseya incident in 2021).
- *No specific MITRE ATT&CK IDs were provided in the text.*
## Targeting
- **Sectors:** Historically targeted high-profile individuals (Lady Gaga, Donald Trump) and large US companies (Kaseya). The specific carding operation detailed focused on **U.S. citizens** for credit card exploitation.
- **Geography:** Targeting focused on **U.S. citizens/entities**. Arrests and legal proceedings occurred in **Russia**.
- **Victims:** Specific victims of the carding fraud are U.S. credit card holders. Historically targeted Kaseya.
## Tools & Infrastructure
- **Malware families used:** Malicious software used for carding fraud (specific name not listed); historically associated with REvil ransomware.
- **Infrastructure (C2, domains, IPs):** Not detailed in relation to the carding fraud operation.
## Implications
The Russian prosecution of these actors suggests a compliance effort following diplomatic pressure from the US regarding cybercrime impacting American entities. The article notes the broader implication that Russia may utilize such criminal groups for espionage, providing the Kremlin with plausible deniability regarding state-sponsored attacks, particularly in the context of the war in Ukraine, though the direct allegiance of these specific hackers to the Kremlin is unclear.
## Mitigations
- Defend against malicious software used for financial fraud and data theft.
- Implement strong defense measures against ransomware associated with established groups like REvil (patching, segmentation, backups).
- The internal Russian legal actions do not negate the ongoing threat from other associated or splinter members of the group operating internationally.