Full Report
Despite being sentenced to five years in prison, the court released the four men on time served. The post Russian court releases several REvil ransomware gang members appeared first on CyberScoop.
Analysis Summary
# Threat Actor: REvil (Also known as Sodinokibi)
## Attribution & Identity
The group is associated with Russian nationals. The article discusses the conviction and release of several members by a Russian court, following arrests made in January 2022 based on information provided by the United States.
## Activity Summary
REvil was once one of the world's most prolific ransomware syndicates, known for carrying out high-profile attacks on global targets.
The specific activity detailed in this article pertains to Russian legal proceedings against members:
* Four members (Andrey Bessonov, Mikhail Golovachuk, Roman Muromsky, and Dmitry Korotayev) were found guilty of financial fraud and computer crimes but were released on time served after being held in pretrial detention since early 2022.
* Other members received sentences ranging from 4.5 to 6 years in October 2024.
* Initial international cooperation (US/Russia) stalled regarding charges related to foreign company attacks due to heightened tensions over the war in Ukraine, leading Russian prosecutions to focus primarily on illegal use of bank card data.
* A principal, high-profile past incident mentioned is the 2021 ransomware attack on the IT firm Kaseya.
## Tactics, Techniques & Procedures
The article explicitly mentions involvement in:
* Financial fraud and computer crimes (General conviction basis).
* Ransomware campaigns (In the context of the Kaseya incident).
* Illegal use of bank card data (The focus of the successful Russian prosecutions).
* *No specific MITRE ATT&CK IDs were provided in the source text.*
## Targeting
- Sectors: Broader targeting included the IT sector (e.g., Kaseya). The members convicted domestically focused on financial fraud, often targeting American victims.
- Geography: Primarily targeted American victims. Prosecutions and arrests occurred in Russia.
- Victims: The IT firm Kaseya (2021 attack). Specific individual victims for the financial fraud convictions were not detailed beyond "American victims."
## Tools & Infrastructure
- Malware families used: Mentioned generally as being part of the "REvil ransomware gang."
- Infrastructure (C2, domains, IPs): Not specified in the provided text.
## Implications
The release of convicted members in Russia, even after sentencing, highlights the geopolitical friction impacting international cybercrime cooperation between Russia and the US. While individuals were successfully prosecuted domestically by Russia for financial crimes, charges relating to attacks on foreign companies did not progress, suggesting continued operational challenges for Western law enforcement seeking accountability through Russian judicial channels. The activity of affiliates (like Yaroslav Vasinsky, sentenced in the US) confirms the group's widespread impact despite these judicial outcomes.
## Mitigations
The article focuses on legal outcomes rather than defensive measures. Implied mitigations relate to general ransomware defense protocols, given the group's history as a prolific ransomware syndicate.