In this video, cybersecurity commentator Matthew Rosenquist examines the abrupt disappearance of the high‑profile ransomware group REvil, which had recently demanded tens of millions of dollars from victims such as JBS and Kaseya. He explains that REvil’s public-facing sites and blog went offline on July 13, 2021, with no official statement from the group or any government claiming responsibility. To gauge the security community’s view, Rosenquist posted a LinkedIn poll to his 200,000‑follower network, receiving over 400 votes. The poll presented four possible explanations: (1) REvil will rebrand and return under a new name (43% of votes), (2) Russian authorities instructed the group to lie low amid heightened political pressure (30%), (3) the operators are simply taking a vacation after amassing huge profits (19%), and (4) a covert U.S. offensive operation took down their infrastructure (8%). Rosenquist discusses each option, noting the prevalence of rebranding among cyber‑criminal groups and the geopolitical backdrop of President Biden’s direct appeal to President Putin. He expresses a personal hypothesis that Russian officials likely warned REvil to scrub any evidence linking them to Russia, prompting a self‑initiated shutdown and a probable short hiatus before resurfacing under a new identity. The video concludes by thanking poll participants, inviting comments, and urging viewers to subscribe to the Cybersecurity Insights weekly series.
Chapters
One of the most successful cybercriminal ransomware groups suddenly disappeared without any apparent explanation. REvil is notorious in the ransomware community, pulling off attacks against JBS recently for $11 million, and most recently Kaseya, where they sought $70 million in extortion. They have several attacks in the past few years with demands in the $50 to $100 million range. They specialize in highly successful ransomware as a service business where they attract and recruit low-level affiliates to distribute ransomware for them. And in return, those affiliates then receive a slice of the profits. Now, on Tuesday, July 13th, Their dark websites and their public blog were unreachable. No statements from the group. Radio silent. And no government has taken responsibility for pushing them offline either. So what happened? Did Russia interfere with their operations or just tell them to lay low for a while until the recent political heat subsides? Did the US launch an offensive attack to undermine REvil's ransomware overseas infrastructure? Perhaps they're just taking a vacation to spend the hundreds of millions of dollars fleeced from victims and will return from Macau or wherever when all the money runs out. Now, I posted a survey to my LinkedIn community of almost 200,000 followers. To ask my cybersecurity colleagues what they believed. And after 30,000 views and votes from over 400 brave souls, the results, they're a little bit surprising. So what we see out of this survey is the most popular sentiment was rebranding, which has emerged to be a common cybercriminal tactic when success has overly publicize their brand in the public eye. Many groups over the years have come out and stated, "We're done, we're out, we're retiring," only to return under a different name, but with the same tools and tricks. In this case, 43% of all respondents that voted looked at this option. This is the one that they believed that was gonna happen. Now, the second one, the most, second most popular option was, The fact that maybe Russia might have influenced them to lay low. Recently, the US President Biden escalated the issue of cyberattacks and ransomware to President Putin of Russia. And there may have been some trickle-down effect where elements of the Russian government told the ransomware group to lay low until international political attention subsides. And that option scored 30% of the votes. Now the next one, and we're shrinking down considerably here, you know, even cyber criminals, they need a vacation. And earning hundreds of millions of dollars is pointless if you don't take a little time to enjoy it. So perhaps the hardworking folks at R-Evil decided themselves to take a vacation, splash some laundered cash around, and live life up a little in exotic places before returning back to the daily grind of fleecing victims out of their money. They will return when the money is gone to refill their coffers, and nearly one-fifth of the votes bent this way, coming in at 19%. Now, the last slice here, and this is where it gets a little surprising, The lowest voted option at only 8% was the notion that the United States government offensive cyber warriors were openly hunting and aggressively took down the REvil sites and infrastructure. This action would have been significant enough to cut the cyber criminal organization in such a way that they could not respond, restore operations, or, or simply scared them into hiding afterwards. And there's no doubt the US has various cyberwarrior capabilities for offensive operations, but the audience didn't think that this was the case in this situation. Perhaps operational warfare is very stealthy and has successfully avoided detection by the public. It would be a badge of accomplishment if the US operators did take down, yet the cybersecurity community had no insights to their capabilities. So that would be interesting if it were the case and all the security pros out there mostly have been, uh, you know, deceived. That would be interesting. Personally, I have no evidence to support this theory, but I think the Russian government discreetly reached out to the REvil group and sternly advised them that they need to carefully inspect all of their data, code, records, systems, to be absolutely sure nothing points back to the Russian government. The veil, no matter how thick or thin, must not be pierced to implicate the government in any way. And because of that, I think that REvil voluntarily took down their sites, their infrastructure, tools, communication outlets, to scrub and clean any possible links, messages, references, infrastructure pointers, Easter eggs in their code and communications that could implicate a connection to the Russian government. After which, hm, they'll probably take a short break and be back to normal, perhaps with a new name and new marketing collateral. That wouldn't be a surprise. So there you have it, the results of the LinkedIn survey. Thanks to all who participated and left insightful comments. Perhaps the coming days or weeks, those events will reveal precisely what happened. But until then, even the wildest theories are possible in this crazy world of digital cybersecurity. Thank you for watching, and be sure to subscribe to catch all the Cybersecurity Insights weekly videos.
