Full Report
Despite being sentenced to five years in prison, the court released the four men on time served. The post Russian court releases several REvil ransomware gang members appeared first on CyberScoop.
Analysis Summary
# Threat Actor: REvil (The REvil Gang)
## Attribution & Identity
The threat actor is the notorious cybercriminal group **REvil**, also known as the **Sodinokibi/REvil** affiliate network. The article focuses on legal proceedings against several alleged members in Russia.
Known Members Sentenced/Detained (Admitted Guilt):
* Andrey Bessonov
* Mikhail Golovachuk
* Roman Muromsky
* Dmitry Korotayev
* Daniil Puzyrevsky
* Ruslan Khansvyarov
* Aleksey Malozemov
* Artem Zayets
An affiliate, Ukrainian national **Yaroslav Vasinsky**, was sentenced in a U.S. court. **Yevgeniy Polyanin** remains wanted by the U.S. authorities.
## Activity Summary
REvil was historically one of the world's most prolific ransomware syndicates, carrying out high-profile attacks globally.
The context centers on the legal outcomes for several members in Russia:
1. **Four Members Released (June 2025):** Andrey Bessonov, Mikhail Golovachuk, Roman Muromsky, and Dmitry Korotayev were found guilty of financial fraud and computer crimes but released on time served after their arrests in early 2022.
2. **Other Sentences (October 2024):** Other members received sentences ranging from 4.5 to 6 years.
3. **Initial Cooperation:** Russian authorities arrested 14 suspected operators/developers in January 2022 based on U.S. intelligence. This was viewed as a rare instance of Russo-U.S. joint action, though cooperation later stalled due to tensions over the war in Ukraine. Consequently, charges related to foreign attacks did not progress in Russian courts; prosecutions focused primarily on illegal use of bank card data.
4. **Notable Campaign:** REvil played a principal role in the **2021 ransomware incident involving Kaseya**.
## Tactics, Techniques & Procedures
The article only specifies the nature of the crimes rather than providing detailed technical TTPs, but notes:
* Financial fraud.
* Computer crimes (related to financial fraud in Russia).
* Ransomware attacks targeting foreign companies (historical context, e.g., Kaseya).
* Extortion attempts (linked to wanted member Yevgeniy Polyanin).
*Note: Specific MITRE ATT&CK IDs were not provided in the article.*
## Targeting
* Sectors: Primarily American victims (for the charges pursued in Russia); historically targeted global entities (e.g., Kaseya victims).
* Geography: Victims primarily located in the **U.S.** (for crimes prosecuted in Russia). Operations were global.
* Victims: **Kaseya** (2021 incident).
## Tools & Infrastructure
* Malware families used: **REvil Ransomware** (Sodinokibi).
* Infrastructure (C2, domains, IPs): Not mentioned in detail. The article notes **confiscation of luxury vehicles and cash** totaling hundreds of thousands of U.S. dollars from the defendants.
## Implications
The legal processing of REvil members highlights a complex dynamic in international cybercrime prosecution: initial cooperation between Russia and the U.S. against major cybercriminal elements (like REvil) followed by a stall in progress due to geopolitical tensions. The release of key affiliated members in Russia on "time served" for crimes that clearly impacted U.S. victims suggests that Russian judicial focus remains heavily weighted toward internal financial crimes rather than prosecuting sophisticated international extortion campaigns, especially when bilateral relations are strained.
## Mitigations
No specific mitigation advice related to actor TTPs was provided in the article, as the focus was purely on the legal proceedings. General defenses against REvil typically include:
* Robust Kaseya VSA instance patching and segmentation (following the 2021 incident).
* Strong perimeter defenses against sophisticated initial access vectors utilized by ransomware groups.
* Comprehensive data backup and recovery strategies.