JACK: Yeah, scams going on out there today are getting wild. There was this one I read about;
let me tell you about it. [MUSIC] Okay, so there’s this guy named Gustavo. He’s from Brazil,
but he was in the US just visiting. He wanted to drive for a rideshare company like Uber but
he was just visiting, so he didn’t have a US driver’s license. Now, as you can imagine,
a requirement to drive for Uber in the US is that you need a driver’s license in the US.
Gustavo thought about it and decided to try to use someone else’s driver’s license to register
to drive with Uber. I’m not exactly sure how he borrowed someone’s identity, but I imagine it’s
not all that hard to find someone’s information online these days. I mean, I’ve seen people post
pics of their driver’s license to social media. So, maybe he just took one of those and sent it
to Uber to pass verification. Anyway, however he forged the driver details, it worked. He was
approved to drive for a rideshare company, and he had it set up so he’d get paid for the work
he did. It was great for him to earn money while staying in the US, and the money was
a whole ‘nother scheme he was working on. I don’t really know how, but he had to move
it around in such a way that it didn’t look like he earned it through rideshares or something. I
don’t know, but he was laundering the money. Well, his girlfriend was also interested in all this,
and she wanted in. But again, she was from Brazil and not a US citizen, so no driver’s license,
either. But not a problem for Gustavo; he just repeated what he did for himself and set her up
with a fake driver account, too. Then three more of his Brazilian friends wanted in, and
before they knew it, this was a five-person team. Then someone on the team was like [MUSIC] hey,
I found a spot online that people are willing to buy Uber driver accounts, because apparently there
are quite a few people who want to drive for Uber but can’t for some reason. Either they don’t have
a license or insurance or something makes them ineligible, so they might be interested in buying
someone else’s account so they can make some extra cash, or even rent one out from someone.
So, these five Brazilians started posting rideshare driver accounts up for sale on these
forums and they were actually selling, making money from just selling driver accounts made from
stolen identities. But then the pandemic hit and rideshare usage went way down, but that wasn’t a
problem. This team just shifted focus and worked on food delivery apps like Grubhub. They started
making all kinds of driver accounts for this now using stolen identities again, and sometimes there
was this waitlist to get verified and stuff, but eventually they would get verified and then
sell or rent out those accounts. Gustavo and his four other friends made over one hundred phony
driver accounts on these apps and sold them on forums. I don’t know how much these things
go for or how much he made, but somehow the authorities got wind of this and investigated,
and ended up arresting all five of them. Stolen identities and money laundering were the main
charges they faced, and I think all of them got two years in prison for this wild scam.
(INTRO): [INTRO MUSIC] These are true stories from the dark side of the internet. I’m Jack Rhysider.
This is Darknet Diaries. [INTRO MUSIC ENDS] JACK:
So, why don’t we start out with what you – what’s your name and what do you do?
WILL: My name is Will. I work for the Equinix Threat Analysis Center.
I’m a threat intelligence analyst. JACK: I wanted to talk with Will because
as a threat intelligence analyst, he’s been studying a certain kind of malware called REvil,
and I want to hear all about it. WILL: So, REvil first sort of appeared in
– I think it was about April 2019, and I got my first job in summer of 2019.
I just graduated university and I got my job in summer of 2019, so I’ve been tracking them ever
since I began my career, basically. JACK: Okay, so you might be wondering what
is REvil? Well, to answer that, let’s back up a bit [MUSIC] and
look at what came just before it. WILL: So, REvil first came out of another
variant called GandCrab, and the sort of – GandCrab is – it was basically the group that
pioneered what we call big game hunting. JACK: So, GandCrab is the name of some malware,
and specifically it infects machines and encrypts the whole hard drive and then says
pay us some money and we’ll give you the key to unlock this machine. GandCrab is ransomware, and
a particularly effective one, too. I think this GandCrab ransomware was developed and deployed by
a group of criminals who kept it close to their chest. It wasn’t passed around for just anyone
to use. At least, not the whole thing. One piece of it did just the encryption for the machines,
and then there were servers that were set up for handling incoming payments and to chat with
victims and to generate decryption keys. It kept updating over time, adding new features,
and it became its own brand. Like any brand, the name of it started to refer to the people
behind it, too. Like, when I say Google, do you think of the search engine or the
company or the people at the company? Google refers to all these things. So, GandCrab was
both the name of the ransomware and the group who were running it, and Will says it was this
group that pioneered big game hunting. WILL: So, big game hunting is a type of ransomware
attack. So, it’s – imagine you have the Savanna and you’ve got all the companies on the landscape.
Instead of going for just small companies and going for the small game, just trying to get
like $5,000 or $10,000, they want to go for the biggest company they can and unlock all their
systems and try and steal millions from them, try and extort them, fall back for their files that
are locked for as much money as they can. JACK: Mm-hm, I get it. So, if I got hit with
ransomware or you got hit with ransomware on our home computer and that hard drive was encrypted
and locked, whoever did it might only charge us a few hundred dollars to unlock it, ‘cause it’s just
one person. This could scale up if you infect thousands of people’s home computers at once,
and that does add up for criminals. But it sounds like this GandCrab group wasn’t trying to hit
regular people like you or me. They were focused on infecting big companies or companies that had
a lot of money at least, because those companies might just pay a million bucks to get their
machine unlocked. [MUSIC] But there’s a bit of a problem with this whole plan; security. Infosec
teams everywhere know about ransomware, and they put methods in place to stop their company from
getting hit with it. So, even though GandCrab was great at encrypting machines, it still needed
that initial access into the network. So, how does a criminal get access into a big company’s
network? Well, they buy their way in. WILL: So, there’s a whole ecosystem of – that
ransomware works with called initial access brokers, and there’s entire underground markets
that you can buy access into certain companies.
JACK: Yeah, I actually know about this. I’ve seen underground forums where people are selling
access into companies. In fact, I interviewed a guy who did sell a login to his ex-employer’s
network. That’s Episode 108, called Mark. He was a disgruntled ex-employee, but there are
also people who are out there just playing around, trying to find a way into a company. Maybe they’re
just curious or like the challenge, but they poke and prod until they find a way in. But they have
no idea what to do once they get in, so that’s where they see others are selling access into
networks on forums and decide to just sell their access. It’s a weird and strange market. So,
this is how the GandCrab group would infect companies; they’d buy access into a company,
then put ransomware on all those systems, and ask for a huge payment to unlock all
those systems. But how much do you demand, and what companies should you hit? Well, to
figure that out, GandCrab did some OSINT. WILL: [MUSIC] I mean, this thing’s like – there’s
a website called ZoomInfo, I think. I’ve seen them on the underground forums literally mentioning
linking to the websites; here’s how much they have in daily – in yearly profit and turnover.
JACK: Oh man, what a mess, huh? Publicly-traded companies have to disclose their profits to
shareholders so they can see what’s going on. But of course, criminals are taking a look
at that too, and they’re like oh, this company had a stellar year. That’s a nice juicy target.
Anyway, so this is what GandCrab focused on, companies with lots of money that they could
get into. They’d get in, encrypt the systems, and demand ransom to unlock
everything. And guess what? Companies were paying this ransom hand over fist.
WILL: Yeah, if you can believe these criminals, they claim they earned $2 billion,
roughly two-and-a-half million a week. JACK: I, for one, don’t believe that number at
all. I mean, they posted these numbers themselves, and I think they just posted big numbers to look
like they were doing great. I’m guessing it’s more like $2 million that they made,
not $2 billion. But that’s still amazing profits, though. Now, GandCrab wasn’t just ransomware,
but it evolved into ransomware as a service. If you wanted, you could pay to use this ransomware
to infect a company, but you’d have to first get access into that company in order to deploy
GandCrab into it and infect it. But then the GandCrab team would handle it all from there,
working with victims to collect money and supply a decryption key. Then you’d get paid
if the victim paid up. Some of these people who used GandCrab as a service got arrested
in different places in the world because as you could imagine, extorting people and companies
is illegal. But as GandCrab grew, they needed to recruit more people to their team.
WILL: On the forums that they recruited cust – where they got customers from, they all speak
Russian. These are all Russian-speaking threat actors. There’s a number of countries that speak
Russian, but there’s only so many countries that allow cyber-criminals to operate with
almost impunity except a very small margin – marginal amount, and that’s Russia.
JACK: Okay, so yeah, there’s not much you can do to stop cyber-criminals operating out
of Russia. The US has no jurisdiction or way to work with Russian to arrest these people,
and Russia doesn’t seem to care too much if it’s not attacking Russian companies. So,
it seemed like GandCrab was living large. It had all the people, malware, victims, and customers
all set up, and the cash flow was pouring in, and no trouble from the police. [MUSIC] But then it
all suddenly stopped. GandCrab posted on a forum saying they’re retiring. You know what? I get it;
it makes sense. They earned $2 billion. I’d retire, too. But they didn’t retire. They
spent time retooling, innovating, and improving their ransomware as a service business. They
created a new ransomware malware. This time they called it REvil, and victims started
seeing what this could do firsthand. WILL: So, REvil first appeared in April 2019,
and it sort of began with – in the first zero to two months, it did the things that most
ransomware does, which deletes backups, changes the wallpaper, does – they actually do a language
check, so before a ransomware is executed, it will check the language that your computer is set to,
and if it’s set to a list of countries that are members of the – what you call the Commonwealth
of Independent States, the CIS – so if it’s a member of the CIS, then the ransomware will not
execute and it will just exit. So, whoever is behind REvil doesn’t want to target countries
that are basically ex-Soviet Union. JACK: So, REvil came on the scene, which again
is the name of both the ransomware and the group operating it.
WILL: I call them REvil because they – I’m pretty sure that’s what they called themselves. It’s
based on Resident Evil. They called themselves R Ransomware Evil, short for REvil. I mean,
GandCrab, there was about five versions of it. So, it was sort of like an experiment until they
came out with REvil, which was basically the crown prince of ransomware. [MUSIC] It was so
perfectly developed for what it was designed to do. It just sort of – every – all their
entire work had sort of – this was like their magnum opus of ransomware.
JACK: But here’s the thing; the group behind REvil saw how much money GandCrab made as a service
that they realized that’s what they should focus on. Offering ransomware as a service
was more profitable than putting ransomware on systems themselves. The idea here is that other
criminals in the world would get access into the networks, and then they could use REvil to infect
that network with ransomware. Then REvil does the rest; collecting payments, decrypting systems,
helping victims get themselves sorted, and then they’d split the ransom with whoever deployed
it on that company. So, criminals all over were using REvil to infect systems with ransomware,
and they called their customers affiliates. WILL: It would all start with the affiliate
wanting to launch an attack. They can either do it by going to REvil first and becoming an
affiliate and have a plan to use their malware, or the affiliate can launch an attack and then go
and physically buy access to one of these – this – these ransomware platforms and then deploy it. So,
it’s different stages of when REvil would be introduced. It would start with the OSINT, it
would start with picking a target, it would start with going to the underground forums looking for
a way in, because you can buy RDP credentials. You can buy cookies. You can buy just e-mail account
credentials and then start from there, or you can do that sort of initial exploitation yourself.
One of the most common ways that REvil used to arrive inside the network was via exploiting a
vulnerability in a public-facing server. So, once the vulnerability had been exploited,
they would deploy a web shell or some – launch some power shell codes on the server,
establish that initial foothold, and then do some reconnaissance inside the network
and then spread around as best they can, and as well as escalate privileges. [MUSIC]
Then once they are spread around enough and they’ve escalated their privileges to domain
administrator level, then they will introduce the ransomware. One of the most – the common
way they deploy it is via scheduling a task on all the computers in the network via using the
domain administrator credentials. So, then everything is rebooted and you have about –
you could have thousands of machines at any one time. I believe – I think it was one – a telecom
company in South America had 15,000 workstations locked up overnight, and each one had the – had
an – a blue background saying, ‘You have been attacked by REvil. Open for – open the note for
instructions on how to pay the ransom.’ JACK: Early on when REvil was first coming up,
Will got to see the impact of them firsthand. He was traveling out of London and had to go through
the Heathrow Airport to fly somewhere. WILL: In Heathrow you have these currency
exchanges run by a company called Travelex. When I went into the currency exchange, I saw everything
was extremely hectic. People were shouting, it was an extremely long queue, and I was like,
what the hell’s going on? Then I realized; I was like oh, I remember reading a report
not too long ago that Travelex had been hit by REvil ransomware. I took a pic – I basically
took a picture on my phone ‘cause I could see all the employees were using pens and
paper and clipboards and things because none of the computers worked. Everything was down
for weeks. This was about three weeks after the attack had happened, and Travelex reportedly
paid a $2.3 million ransom, I believe. JACK: [MUSIC] Whoa, what a payday. I mean,
you can put ransomware on a lot of systems, but if nobody ever pays to get their stuff unlocked,
then it’s all for nothing. But when someone pays $2.3 million to have their computers unlocked,
then that’s the fuel that makes REvil ransomware crew keep going. Some people think this whole
ransomware thing can just all go away if we all agree to never pay the ransom ever again. But the
truth is, companies are still paying in a big way, which incentivizes ransomware crews to keep at it,
and there’s no guarantee these companies won’t get re-infected the next day and have to pay it
all again. Clearly, the best idea if you get infected is to have good backups that you can
restore rapidly. But REvil knew this, so they purposely looked for how systems got backed up,
and then they went and wiped those backup servers first. This is probably why it was so effective.
If the company had their backups wiped out and no path of rebuilding, it’s a lot cheaper to
pay a few million dollars to get things back up and running. I mean, three weeks of being down
could cost the company over $2 million in losses anyway. Surely it’s a tough spot for any company
to be in. After a while, researchers started to notice a guy named Unknown who kept making posts
on the forum claiming to be part of REvil. WILL: So, he used to post to two Russian-speaking
underground forums. One of them was called Exploit and another one was called XSS. So,
kind of typical names for hacker forums, but these two forums have been going for like,
about fifteen years and they’re basically the two most popular hacking forums for Russian – like,
hardened Russian cyber-criminals. [MUSIC] He was basically saying – boasting how REvil was
the best ransomware. So, it was competing with several other strains at the time,
including Maze and Ragnar Locker, I think, as well. He basically became the frontman of the
whole operation. Everyone – it was like his net – his alias was basically synonymous with REvil,
and yes, he went on to do interviews with several people online. They’d interview him,
say how did you decide to get into the business of ransomware, or how much money have you made – make
doing ransomware? Those sort of questions. Yeah, it sort of – it just makes it sound like it’s a
huge – it’s a big order – it’s basically a big organization of cyber-criminals. I would probably
say there’s anywhere between ten and twenty individuals actually connected to the running
of the REvil core business, the core ransomware as a service business.
JACK: Another thing this Unknown guy was saying was how REvil was doing more to extort
people than just demanding ransom. WILL: They would then step it up a notch by
leaking – stealing data and then leaking it with – to a Tor website. Because it’s on Tor, you can’t
get it taken down. It’s like a wall of shame. That’s what they call it. It’s there forever. Then
you know, a few months later, they’d add another level of extortion. So, that’s what we – they
used to call double extortion, was encrypting your files and then leaking your data. They had a third
level; they would now begin to DDoS you or your partners, and they would DDoS your websites until
you actually began negotiations with them. JACK: Whoa, wait? What? They’re DDossing you,
too? This is where they flood your website or service with so much traffic that your
website is just completely unusable. It’s a low blow to hit you while you’re down.
WILL: If you still haven’t entered the chat with them – because in the ransom notes they have a
link to the chat – if you haven’t entered the chat with them to negotiate paying the
ransom or anything like that, they basically believe oh, you’re able to recover. Like,
no – if you’re a big company, like international company, then you will basically have backups,
you’ll be able to restore files, you’ll be able to basically carry on after a few weeks of recovery,
rebuild the network, whatever. So, REvil didn’t like that, when companies can recover on their
own, so they will DDoS your website. If you have – say if you’re – you have a – you’re
a retail company; you have customers coming to your website. Every hour is money, so if
they’re DDossing you, taking it down, they’re still costing you more and more money.
JACK: Okay, up until this point I’ve been referring to REvil as a ransomware group,
but at this point, this is mean. This is more like street gang behavior, going around hurting
people and robbing them without any remorse. So, I’m gonna now start referring to them as
the REvil cyber-gang, because these guys were ruthless. Here, let me play something for you.
This is a voicemail that a ransomware gang member left on an employee’s phone, a victim’s
phone. It’s not from the REvil cyber-gang; it’s a different one called SunCrypt, but I
think it’s worth playing here just to give you an idea how cold-blooded these guys can be.
SUNCRYPT: This message is to authorized IT specialist or to company management
representative. We are SunCrypt group. We hacked your company yesterday and now we
have around 80 gigabytes of your company data encrypted to new servers as well as downloaded
to our servers. We have personal information, partner data, financial and accounting data of
your company, and much more. You need to start negotiations with us about decrypting your IT
servers and bringing your company data back. Negotiate with us and you will get a decrypter,
together with all your data back, within one day. No one in the world will know about this leak,
but in case of your refusal to cooperate, we will run a great damage to your business. You will lose
ten times more in courts due to violation of the laws on GDPR and your partner’s data leak. We will
inform your employees, partners, government, about this leak. Your data will be published
in public blogs and told to competitors. We will inform media about this successful cyber-attack
to your company, and backdoor access to your company data will be sold to other hacker groups,
and this will be the last day of your business. We don’t want to do that for sure, and we will not do
that if you will negotiate successfully. So, we are waiting for you in the chat. Think about your
future and your families. Thank you. Bye. JACK: Think about your future and your families?
Whew, that’s so ominous. I mean, what would you do with a threat like that? Now, sometimes the
REvil cyber-gang would just go infect targets themselves, and if they did, they’d get to keep
100% of the ransom they make from that. But in most cases, they worked with their customers or
affiliates to infect the targets for them. WILL: So, it is known that they would – they
basically split the ransom with the affiliate. They’d say, if you hit a company and you’re
able to get them to basically agree to pay a $10 million-ransom, it’s – we’ll keep $60 million,
you’ll get $40 million. Like a 60/40 or a 70/30 split, because they’re – at the end of the day,
REvil, the RaaS, the ransomware as a service, would provide not only the malware but also
the decryption, functionality, which was one of the – is one of the best,
most complex decryption systems of any of the ransomware families at the moment, even. Then
they would – they add all the infrastructure for darknet chats, darknet payment sites, money
laundering. They fried a lot of back ends. So, it’s a worthwhile split for both parties.
JACK: So, it was on the affiliate to figure out a way into the networks
to deploy REvil as a service. WILL: So, I believe the affiliates are
choosing the targets. They’re basically getting into these companies, doing the – they basically
do the legwork, as I’d like to describe it. Like, somewhat – it’s a whole ecosystem. You
have someone who gets an initial foothold in the network. They’re called the initial access broker.
They will sell that – however small it is or big it is, they’ll sell that to someone else, the
REvil affiliate. The REvil affiliate will spread around the network and escalate privileges and
steal data. Then they will deploy REvil. JACK: [MUSIC] It’s just nasty, like all of it. For
REvil to make it a turnkey solution so it’s easy for anyone to commit crimes with, and then people
are just buying their way into these companies, sometimes through disgruntled ex-employees. Then
REvil comes in and destroys backups and encrypts everything and then DDosses you and then taunts
the victim until they pay; it’s awful. But we’re just getting started. You gotta hear what they
do next and what happens at the end of all this. We’re gonna take a short break here, but stay with
us. REvil continued to infect companies and make millions of dollars from these ransoms. I believe
there are lots of companies that we’ll never know about that got hit with this, but there are
some companies we do know that got hit with this, because it made the news. One of them was in 2019,
and the victim was the Texas government. WILL: Yeah, so the Texas government one
was interesting because it sort of started a trend that REvil liked to – it was – it ended up being
deployed at what you call a managed service provider, which is an IT company that handles
the IT of other organizations. So, the Texas government, they actually paid a single company
to just manage the IT of all their institutions. Each institution doesn’t have to have an IT
department then; it’s just one company that does it all for them. So, one of the REvil affiliates
managed to get into the Texas government and deploy – I think it was twenty-two different
governments that ended up being – entities ended up being attacked in this one instance.
JACK: This one made the CBS news. HOST1: In Privacy Watch now, government
computers in twenty-two Texas towns are being held hostage by ransomware. The state’s
Department of Information Resources said that the coordinated attack happened on August 16,
and many of the local governments still have not been able to get back online.
JACK: [MUSIC] See, when so many government facilities have a computer outage all at
the same time, it makes the news because it’s a noisy problem. It’s not something
you can easily cover up quietly or make it go away quickly. Of course, REvil was saying hey,
all these problems can go away if you pay us $2.3 million. But the Texas government did not
enter the chat and did not pay a single cent. They recovered all on their own somehow. In May 2020,
a company called GSM Law was the victim to this cyber-gang. Here’s CNBC news.
HOST2: An entertainment law firm run by Allen Grubman confirming its computer systems were
hacked. The hackers say they have sensitive information about several big-star clients, and
those hackers want $42 million in ransom. JACK: [MUSIC] Whoa, $42 million? That’s the
largest ransom payment ever demanded at the time. They must have stumbled
upon something spicy in that network. WILL: So, some of GSM Law’s clients include
Madonna, Elton John, Lady Gaga, and probably most famously, Donald Trump. It’s a big New York law
firm, so Donald Trump, he’s lived in New York his whole life. So, REvil managed to get into
GSM Law and steal – allegedly steal hundreds of gigabytes of data from them; 756 gigabytes, they
claimed. They threatened to basically disclose Donald Trump’s solicitors’ information, like
from his lawsuit. Everyone knows Donald Trump has like, thousands of lawsuits on the go. So, REvil
was basically able to go through them all. JACK: Huh, that’s interesting. REvil is presumed
to be operating out of Russia. I wonder if they had to stop for a moment and think about
what to do with Trump’s legal documents. WILL: It became a whole thing. Everyone was saying
oh, this is like cyber-terrorism or whatever. How can Russia allow this to happen? This is meddling
with the presidency or whatever, ‘cause he was still president at the time. Yeah, it – basically
REvil said – they had to come out and make a statement, like we are apolitical, we’re just
financially-motivated criminals. We don’t want to cause any problems. They actually seemed to – I
mean, it’s kind of a weird thing to say, but they actually seemed to like Donald Trump, I think
‘cause they were – they thought of themselves as these ultra-rich, super-smart cyber-criminal
masterminds, and they sort of admired Donald Trump as he was really rich as well.
JACK: [MUSIC] Hm, research into this is a little murky. REvil had released a little bit of what
they stole to prove they had something from one of GSM Law’s clients, and then they said the next
person we’re gonna dump records on will be Trump. One news agency looked into this and said Trump
isn’t even a client of GSM Law. So, we think Trump probably wasn’t a client and just mentioned in
some lawsuit. But you might wonder what happened next with GSM Law? Did they pay the ransom or
what? Well, we don’t know. Nothing happened. We never saw REvil release any data on Trump or
dump a bunch of legal documents, so that makes me think that either they never had the data, which
they did lie sometimes, or GSM Law negotiated the ransom. I’m not exactly sure what happened with
that. Now, ransomware at this point was looking like a very lucrative way for criminals to make
money. If you think about it, suppose you hack into a company and you were a criminal and you
wanted to profit off this access. What are your options? Okay, well, you could sell your access
that you have, but I can’t imagine this making very much money; maybe a thousand bucks.
You could try to install some cryptominers on there, but that’s such a slow process to make
money from. You could try to look around for some database to steal and then maybe sell that
database to someone, but that’s a tough market to be involved with. You could do a business e-mail
compromise attack and try to figure out what’s going on in the finance department and see if you
can get them to send you some money, or you could look around to see if there’s anything valuable in
the company to steal, like money, right? In fact, there was another group at the time called FIN7,
which focused on hacking into banks and stealing credit cards. Well, you would think that that’s
a very good way to make money illicitly, and it is, but FIN7 was seeing how much easier it
is to just put ransomware on a computer and just leave it at that, because there’s a lot
of work to dealing with thousands of credit cards or trying to launder money and make it
clean. But it’s so much easier to just wait for a single ransomware payment in Bitcoin and then
move on. Since FIN7 was already pretty good at breaking into networks, this really turned them
on to a whole new revenue stream. WILL: Yeah, so DarkSide was FIN7’s first
ransomware project. They had tried out REvil for a few times. Their infrastructure had been
connected to REvil attacks via pivoting on IP addresses and things from known attacks. FIN7
basically realized okay, every time we use an – every time we launch an attack using REvil,
we have to give them a cut. Isn’t it just easier if we develop our own ransomware and then launch
our own attacks? Then we don’t have to give a cut to anyone. We can keep it all for ourselves.
So, after a time they realized okay, it’s actually – you make even more money if you begin ransomware
as a service, because then you just rent out the ransomware to multiple groups and begin
making money your own way. JACK: Wow. So, at that point,
FIN7 had totally quit robbing banks and turned into a ransomware as a service business because
of how profitable they saw REvil was. WILL: [MUSIC] Ransomware is the most valuable
way to make money when you’re inside any network, anywhere in the world.
JACK: FIN7 was one of the most profitable criminal groups out there, so it’s just crazy to hear how
they switched from robbing banks to ransomware. But at this point they became competitors, and I’m
not going to go into any more details about FIN7 or DarkSide in this episode, but rest assured,
that’s a really interesting story all by itself, and I’ll have to cover that in an episode someday.
Now, when REvil gets a ransomware payment, they typically receive it in Bitcoin, and then
they’re actually pretty good at laundering that money by typically converting it into Monero,
which is much more secure and I think untraceable, and then they’d be able to cash it out without it
leading back to whoever is behind REvil. But I have to imagine how insane of a chat it must be
when a company does want to pay a million-dollar ransom in Bitcoin. These ransomware negotiation
chatrooms must be the wildest thing ever. WILL: I’ve heard from ransomware negotiators and
incident response people that these ransomware teams have much better customer service than
most companies do. They will guide you step-by-step the whole way on how to pay
a ransom, how to get the cryptocurrency, how to store it, how to send it to them,
all the checks, all the balances. JACK: I mean, can you imagine being the
IT admin and all your computers are encrypted, and your management has given you the go-ahead
to pay the ransom? So, you get on Tor and enter the ransomware negotiation chatroom. You might
say okay, look, we’re willing to pay, but we don’t have any Bitcoin. Can we just wire you the money?
REvil ransomware negotiators are like LOL, no, that’s traceable. You need to send us Bitcoin.
Go to an exchange and buy some. [MUSIC] Here’s the problem; you can’t just show up to Coinbase
or Gemini or Binance or whatever and be like uh, yeah, I’d like to buy $2 million in Bitcoin,
please. No, they have daily limits set up. You can only buy a few thousand dollar’s worth at a time,
so you call up customer support at an exchange and you tell them listen, I want to buy $2 million
worth of Bitcoin. The exchange might be like whoa, that’s a lot of money. What’s that for? You’re
like oh, it’s to pay a ransom. That’s a red flag for the exchange. I think by law, exchanges can’t
sell you Bitcoin if they know you’re going to use it to pay a ransom with. So, it becomes a huge
ordeal just to secure that much Bitcoin. WILL: You have to remember that when
millions of dollars are involved here, like if a company, it says okay, yeah,
we plan to pay $5 million in a ransom, they will hire a expert to help them with it. So, there are
ransomware negotiation firms now that their whole job is to help companies get through when they’ve
been hit by a ransomware attack. So, these negotiators know all the ways to pay a ransom,
basically. They know – they even know – they keep track of all the wallets, they keep track of all
the contact details of each ransomware group, so they know – sometimes if these negotiators
respond to multiple incidents, they will be able to recognize the person on the other end
of the ransomware negotiation portal. JACK: What? There’s a whole industry out there
helping people negotiate and pay ransom? This is madness. I mean, think about it;
imagine if you’re in the chat with REvil and you’re like, how do I do this? They’re like okay,
well, you could just call this company and they’ll help you walk through it. It’s just
so zany to think about this. I wonder, do these ransomware negotiators offer any sort of referral
program? So, if REvil refers them and they hop on the chat and like oh, hey Dmitri, how’s it going?
Thanks for referring me. I’ll make sure to get you that referral bonus. Or take it a step further;
imagine REvil refers you to a quote, unquote “expert service” who’s just another criminal,
and you give them $2 million to buy Bitcoin and they just take off with the money.
WILL: Well, there are legitimate companies, but as you say, this could easily be taken
advantage of and has been by companies that really do some really shady stuff. Like,
say if a company gets hit by ransomware, sometimes they’ll come in and – the company will come in,
like the response company will come in, and say yeah, yeah, we can deal with it all for
you. How much did the ransomware gang tell you it was gonna cost? Oh, $4 million. Well,
actually it’s gonna cost $5 million. Then they’ll pay the ransom, decrypt the files,
clean the network, and then be like yep, here’s your – here’s your bill; $5 million.
But you just used the decryption key. JACK: [MUSIC] If you turned on NBC News,
on June 1, 2021, you would have saw this. HOST3: It’s another attack on critical
infrastructure, this time the food supply. The world’s biggest meat producer, JBS, forced to
curtail operations after a ransomware attack. At least six plants in the US shut down. Operations
also affected in Australia and Canada. WILL: That was a huge international incident.
Everyone said that was the one step too far.
JACK: JBS is the largest meat supplier in the US. I think they produce over 20% of the meat
for the US, with locations in Canada and Australia. Because it was so big,
it was deemed critical infrastructure. If the food supply chain is unable to deliver food,
well, that can be a really big problem. HOST4: The meat-packing firm JBS USA paid a
ransomware equivalent to $11 million after it fell victim to a cyber-attack. The company’s US CEO
said on Wednesday they made the payment to protect their customers. Last week’s cyber-attack led to
the suspension of cattle slaughtering at all of JBS’s US plants for a day. The company produces
nearly a quarter of America’s beef. JACK: $11 million paid up. That’s a lot of
Bitcoin to send over to someone that you hope will fulfill their end of the deal and give
you an encryption key. What a nail-biter that’s gotta be when you click Send and
you’re just sitting there in chat, waiting for the criminal to give you a key. Whew.
WILL: There was another company that was another, in quotes, “step too far”. They’ve done it now.
They hit a company called Sol Oriens, which was a nuclear weapons contractor for the US. This is
like, okay, now you’re affecting the nuclear triad or something like that, you know? How can this
ransomware group get away with all of this? JACK: But still, we haven’t gotten to REvil’s
biggest hits yet. Over this period of years, REvil was getting into hundreds of companies
and putting ransomware on them. The ones who didn’t pay would get posted to their blog.
WILL: Their leak site had 282 leaked companies’ data published to it. So,
that’s how many companies didn’t pay, because they were leaked onto the leak site. Some of the stats
coming out of Europol said that they had launched thousands of attacks. [MUSIC] Probably one of the
smartest things REvil ever did was they went into a – what we’d call a cyber insurance company. So,
because ransomware is such a huge thing, companies – like, when they get hit by a ransomware attack,
it can cost them not only X-number of million dollars for the ransom, but to actually clean
up the network and restore it or rebuild it could cost them hundreds of millions. So,
they need insurance to be able to cover that cost for ransomware specifically. So, what REvil did
was they went into an insurance company and they looked at all of the insurance company’s clients
and they hit each target one by one, ‘cause they know how much they were gonna get paid out for
from the insurance cost. Then they hit the insurer themselves as well, for good measure.
JACK: Here’s a clip from CBS News that tells us about the next victim.
HOST5: FBI investigating what may become one of the world’s largest ransomware attacks on
companies – get back to work following the holiday weekend. A Russia-based
cyber-criminal group called REvil is demanding a $70 million-ransom. Hackers
hit IT software company, Kaseya, Friday. WILL: [MUSIC] Wow, where do I begin? The Kaseya,
that was basically one of the biggest supply chain incidents since NotPetya. Kaseya are the
manufacturers of a software called – Kaseya VSA is their software. Companies, like I mentioned
before, managed service providers, will buy Kaseya VSA and use it to do administration on their
customers’ networks. So, by going into the Kaseya software, REvil basically had a foothold into all
of the MSP’s customers. So, by exploiting the Kaseya software to deploy REvil, they were able
to hit 1,500 networks in one go overnight. JACK: Whoa, 1,500 different companies hit with
the REvil ransomware in one day? That’s a massive amount of damage. This is what’s called a supply
chain attack, because REvil was able to get into all of Kaseya’s customers, which were sort of
like tech support companies who had access into other companies, and those companies were hit
with REvil, too. This was a crazy event, perhaps one of the biggest ransomware attacks ever.
HOST6: In Michigan Saturday, President Biden said intelligence officials are investigating.
BIDEN: The director of the intelligence community is gonna be doing a deep
dive on what’s happened. HOST6: Last month, he warned the Russian
president to rein in cyber-criminals or face a strong US response.
BIDEN: If it is, these are – with the knowledge of and/or consequence of Russia,
then I told Putin we will respond. JACK: So, this happened in July 2021. Biden was
president by then. It’s hard to hear, but he said in this impromptu interview in a grocery store in
Michigan that if Russia is in any way involved, then he told Putin he’s going to respond. It’s
wild to me when the president of the US is able to just jump into a discussion about ransomware
off the cuff like that. I felt like such a geek all my life, head down in a computer, learning
about the most geeky things you can imagine, and to look up from the screen and see it talked about
on the world stage like that is just a trip. Oh, look, there’s the president fueling a question
about the REvil ransomware. Far out. So, what were the ransomware demands for Kaseya?
WILL: Well, it was actually one of the highest ransom demands ever in history. They demanded $70
million in Bitcoin. After the attack took place, one of the – it popped up on the REvil blog,
which was called the Happy Blog, by the way. The Kaseya attack popped up and it said – this is what
REvil wrote; they said ‘On Friday, we launched an MSP – we launched an attack on MSP providers. More
than a million systems were infected. If anyone wants to negotiate about a universal decrypter,
our price is $70 million in Bitcoin.’ JACK: I gotta say, this is a situation that Kaseya
probably didn’t plan for. [MUSIC] I mean, suppose they have a don’t-pay-the-ransom policy. Okay,
that’s fine. It’s a good policy to have. But they aren’t the only victims here, and it was their
fault that caused hundreds of other companies to be infected with ransomware. Do you owe it to all
of them as sort of an apology? Like, sorry for getting you ransomwared; here’s the decryption
key. Hope you stay as a customer. This was a preventable problem. There was a vulnerability on
Kaseya’s servers that gave REvil the foothold to take over a server. At least one person reported
this to Kaseya before the attack, too, and I think they were working on fixing it when all
this happened. So, Kaseya must have looked at this $70 million-ransom demand and took a deep breath,
and had a long think about it. WILL: Again, it’s that old thing of,
we don’t want to be the company that’s paid the biggest ransom in history. So,
to give credit to Kaseya, they went straight to the FBI for help, and the FBI are very, very
well-experienced with these types of ransomware attack. So, they guided them and were basically
with them by their side the whole time. At the end of the day, it basically – the decisions
became the FBI’s decisions at the end of the day, from – for what Kaseya was supposed to do.
JACK: Kaseya didn’t pay the ransom. They called the FBI, who apparently sprang right
into action. The FBI actually explained what happens next. Here’s the director of the FBI,
Christopher Wray, in a press briefing explaining what happened.
WRAY: When Kaseya realized that some of their customers’ networks were infected with ransomware,
they immediately took action. They worked to make sure that both their own customers,
managed service providers, and those MSP’s customers downstream quickly disabled Kaseya’s
software on their systems. They also engaged with us early. The FBI then coordinated with a host
of key partners, including CISA and foreign law enforcement and intelligence services so
Kaseya could benefit from all of our expertise and reach as it worked to put out the fire.
Kaseya’s swift response allowed the FBI and our partners to quickly figure out
which of its customers were hit, and for us to quickly share with Kaseya and its customers
information about what the adversaries were doing, what to look for, and how the
companies could best address the danger. Here, we were able to obtain a decryption key
that allowed us to generate a usable capability to unlock Kaseya’s customers’ data. We immediately
strategized with our inner agency partners and reached a carefully-considered decision
about how to help the most companies possible, both by providing the key and by maximizing our
government’s impact on our adversaries, who were continuing to mount new attacks.
When the FBI is engaged early, we can provide victims more and better support. We can get
them intelligence and technical information they need faster, and we can work quickly back from the
intrusion to follow and seize the criminal’s money before it can jump through wallet
after wallet and exchange after exchange. JACK: Hm, he makes it sound like they’re willing
to help anyone with ransomware. I mean, listen to the Deputy Attorney General, Lisa Monaco,
in the same press briefing. MONACO: To Americans watching today,
to those own small businesses, to those who run Fortune 500 companies,
who manage hospitals and oversee school districts, this case is the reason you want to work with law
enforcement. Know that if you pick up the phone and if you call the FBI, this team is waiting
for you on the other end of the line. JACK: [MUSIC] I just wonder if that’s a little
misleading. I mean, people e-mail me all the time telling me about how they were extorted
or scammed or hit with ransomware and just want some advice. Is the proper advice that I should
give them is that they should call the FBI? Just skip the police altogether and go straight to
the FBI? You would think the FBI would have some kind of threshold for how big something
should be before we call them. Like, maybe they only care about larger extortions or attacks on
national infrastructure, not small-scale stuff like my local barber’s website getting their
WordPress site taken over, right? Or the question is, how bad of a computer problem
does it need to be before you call the FBI? There’s a big difference between your whole
network being ransomed versus one user account being compromised. Listen, I’m curious now;
if you’ve ever called the FBI over a computer problem you’ve had, I want to hear from you. Send
me a note. Tell me how it worked out. Did they get back to you right away or wait six months,
or no reply at all? I just imagine the FBI must be flooded with calls and problems,
but there’s no way they can get back to all the people who report computer problems to. Anyway,
sorry, a little rant there. Okay, yeah, what FBI director Wray said was really interesting.
They obtained a decryption key? What? How? That’s amazing. Did they reverse-engineer the
malware? Did they join the chat and pressure the REvil gang to provide a key or else kinda thing?
I’m really curious how they obtained that. WILL: You know, rumor has it the FBI were able to
compromise the REvil servers after – during the Kaseya incident. The FBI is allegedly – because
I don’t know if this is proven or not, but they were able to compromise the
system, the REvil systems, following this. Soon after they post about Kaseya, the ransom – the
REvil servers all go offline. JACK: What we do know is that REvil
went quiet just after the Kaseya hack, and it stayed quiet for months. Then out of the blue,
the FBI gave a press briefing. Here’s the US Attorney General, Merrick Garland.
GARLAND: Today we are announcing that we are bringing to justice an alleged perpetrator of
a significant, wide-reaching ransomware attack. On July 2, the multinational information software
company Kaseya and its customers were attacked by one of the most prolific strains of ransomware
known as REvil. To date, REvil ransomware has been deployed on approximately 175,000 computers
worldwide, with at least $200 million paid in ransom. Six weeks later, on August 11, the Justice
Department indicted Yaroslav Vasinskyi, also known by the online moniker, Robotnik. The indictment,
which was previously under seal, charges him with conspiring to commit intentional
damage to protected computers and to extort in relation to that damage, causing intentional
damage to protected computers, and conspiring to commit money laundering. The indictment charges
that Vasinskyi and co-conspirators authorize – authored REvil software, installed it on victims’
computers, resulting in encryption of the victors’ – victims’ data, including in the July 2 attack,
demanded ransomware payments from those victims, and then laundered those payments.
Two months after the indictment, on October 8, Vasinskyi crossed the border from Ukraine
into Poland. There, upon our request, Polish authorities arrested him pursuant a provisional
arrest warrant. We have now requested that he be extradited from Poland to the United States,
pursuant to the extradition treaty between our countries. In addition to securing the
rest of Vasinskyi, the Justice Department has seized $6.1 million tied to the ransom proceeds
of another alleged REvil ransomware attacker, Russian national Yevgeniy Polyanin. As set forth
in the public filings related to the seizure, Polyanin, whom we also charged by indictment,
is alleged to have conducted approximately 3,000 random – ransomware attacks. Polyanin’s
ransomware attacks affected numerous companies and entities across the United States, including law
enforcement agencies and municipalities throughout the state of Texas. Polyanin ultimately extorted
approximately $13 million from his victims. JACK: Whoa, so they caught one guy who they said
was the author of the REvil malware and seized funds from another guy. This ultimately disrupted
REvil. They weren’t active at all after this. Now, along with these indictments,
they released photos of these people, and here is where Will could look into the eyes of the
people behind this malware that he spent years following and investigating.
WILL: [MUSIC] The indictment dropped, and it had the names of these two REvil affiliates. These
were the first two names we had for any of them. I immediately – and shout out to my guy at my team
in curated intelligence – we joined the voice chat in Discord and we were all just talking
about it and basically celebrating. Then we quickly were like oh, using these usernames
and names and things, we can find all their social media profiles, because we can use OSINT to find
them. We found his VK account and we found his other social media profiles. We found he ran an
Instagram account which was used to sell DDoS attacks with number-spoofing, like phone call
DDoS attacks and things. He even had a certificate for Microsoft and there was a picture of him at
his college and him on holiday and things. Yeah, he just looked like a normal young guy that was
obviously good at IT. It was kind of – yeah, it was surreal just to see him in the flesh.
JACK: Now, it seems like the bulk of the people involved with REvil were somewhere in Russia,
and the US authorities don’t really have a way to arrest people in Russia or even
get Russian authorities to arrest them. But something very particular happened next.
WILL: Yeah, so it was – and very interesting timing. In January, on the January 14, I believe
it was, the Russian FSB released a press release that said they had arrested fourteen members of
REvil from Moscow and St. Petersburg. The FSB said they seized more than 426 million Rubles,
$600,000, and half a million Euros along with cryptocurrency wallets, and twenty expensive cars.
It was this – it made news globally that this – the gang had finally been arrested,
you know? REvil is over. Here’s videos of the FSB busting down the door,
putting them on the ground, and taking them away. It seemed justice has been served.
JACK: Here’s an Al Jazeera news clip. HOST7: [COMMOTION, SHOUTING] The scene was
not uncommon. Russian police and intelligence agents harshly taking down more than a dozen men,
all played out on television. The reason was extraordinary. The Russian government tells
the Biden administration the operation dismantled a group of hackers inside Russia on behalf of the
United States. Security agents took down alleged hackers from the ransomware group REvil at over
two dozen addresses, seizing millions of Rubles, vehicles, and technology. Among
those arrested, alleged ringleader Roman Muromsky, appearing in court in a cage,
and Andrei Bessonov, both wanted by the US. JACK: Huh. That’s it, then. Case closed? Story
over? It’s all nicely wrapped up with a bow at the end, and all the criminals are caught. Well,
I’m not sure. Here, let me show you what I mean. The exact same day of these arrests, on January
14, 2022, CBS News reported this.