FBI Seizes Cryptocurrency Worth $2.3 Million From REvil Ransomware Group Affiliate

The accused Russian citizen and REvil affiliate has been last traced to an address in St. Petersburg.

FBI Seizes Cryptocurrency Worth $2.3 Million From REvil Ransomware Group Affiliate

Photo Credit: Pexels/ Sora Shimazaki

REvil has been operating since April 2019

Highlights
  • The confiscated crypto was linked to payments made to REvil Group
  • The attacks were executed between April 2019 to July 2021
  • REvil Group has been linked to several high-profile attacks

US law enforcement seized 39.9 Bitcoins from an Exodus wallet, worth approximately $2.3 million (roughly Rs. 17.3 crore) from a Russian citizen suspected of being associated with infamous hacker group REvil, known for their ransomware attacks. The Federal Bureau of Investigation (FBI) in a complaint unsealed last week states that the wallet contained REvil ransom payments belonging to an affiliate identified as Aleksandr Sikerin, who has been found employing ransomware viruses to break into databases of American infrastructure facilities.

The complaint, first seen by Bleeping Computer, reveals that Sikerin — who is affiliated with REvil — was responsible for the ransomware attacks that generated about $200 million (roughly Rs. 1,504.76 crore) in payments from victims between April 2019 and June 2021. The cryptocurrency wallet that is now under the FBI's control is "traceable to ransomware attacks committed by Sikerin"

Sikerin, meanwhile, whose last-known address has been traced to the Russian city of Saint Petersburg, has been charged with multiple counts of conspiracy and money laundering. That said, law enforcement officials believe Sikerin is just an affiliate in the vast network of REvil gang.

Ransomware gang affiliates are responsible for frontline hacking work and stealing the data from victims' machines. They usually earn 70-80 percent of the ransom.

REvil, also known as Sodinokibi or Sodin, has been one of the most notorious ransomware groups of over the past couple of years. The group targets company networks using spam, exploits, exposed remote desktop services and hacked managed service providers (MSPs).

While the FBI does not indicate the online alias of the threat actor in its complaint, those over at Bleeping Computer have looked into the email address mentioned in it and found that the name 'engfog' is tied to a REvil affiliate known as 'Lalartu' aka Aleksandr Sikerin — who has named in the complaint.

The news break nearly a month after the US Justice Department charged a Ukraine national and a Russian in one of the worst ransomware attacks against American targets as per court filings.

An indictment back then accused Ukrainian Yaroslav Vasinskyi, who was arrested in Poland last month, of breaking into Florida software provider Kaseya over the July 4 weekend. From there, he and accomplices simultaneously distributed REvil ransomware to as many as 1,500 Kaseya customers, encrypting their data and forcing some to shut down for days, it said.

Vasinskyi is charged with breaking into the victim companies and installing encryption software, developed by the core REvil group. REvil directly handled the ransom negotiations and split the profits with affiliates like Vasinskyi.

REvil, also involved in an attack against top global meatpacker JBS SA, was intercepted in a joint operation, where authorities recovered $6 million (roughly Rs. 45.17 crore) in ransom payments.


Interested in cryptocurrency? We discuss all things crypto with WazirX CEO Nischal Shetty and WeekendInvesting founder Alok Jain on Orbital, the Gadgets 360 podcast. Orbital is available on Apple Podcasts, Google Podcasts, Spotify, Amazon Music and wherever you get your podcasts.
Comments

For the latest tech news and reviews, follow Gadgets 360 on Twitter, Facebook, and Google News. For the latest videos on gadgets and tech, subscribe to our YouTube channel.

Further reading: Revil, cryptocurrency, ransomware
Shomik Sen Bhattacharjee
Shomik is a senior sub-editor at Gadgets 360. As someone who's screened the consumer tech space for the past four years, he's now shifted focus to the crypto-verse. When not converting currency values in his head, you may find him in an intense five-a-side football match or grinding out the newest Destiny 2 weekly challenge on his Xbox. You can reach him for tips or queries at ShomikB@ndtv.com. More
Fortnite Chapter 3 Season 1: Flipped Brings New Island, Weapons and Spider-Man’s Web Shooters
Space Tourism: Russia to Send Japanese Billionaire Yusaku Maezawa to ISS
Share on Facebook Tweet Snapchat Share Reddit Comment

Advertisement

Advertisement

© Copyright Red Pixels Ventures Limited 2022. All rights reserved.