Authorities in Romania Arrests Members of the REvil Ransomware RaaS Family

Romanian officials have reported the arrest of two people for their roles as REvil ransomware family associates, striking a serious blow to one of the most prominent cybercrime gangs in history. While Europol affirmed that the suspects are considered to have harmonized more than 5,000 ransomware attacks and they have also forced close to $600,000 from victims.

On November 4 an arrest took place which was a  part of a joint operation named as GoldDust, this operation led to the arrest of three other REvil members, and out of the three, two suspects have been connected to GandCrab in Kuwait and South Korea.

REvil, which stands for Ransomware Evil, is the successor of GandCrab ransomware and has been linked to a number of high-profile ransomware assaults since its appearance in the threat scene in 2019. The criminal syndicate, which operates as a Ransomware-as-a-Service (RaaS), is known to rent its malware source code to affiliates, usually after validating their technical skills, who are then responsible for carrying out the assaults against eligible victims.

With the help of Interpol and Eurojust, Europol announced the results of the GoldDust operation, in which it was discovered that 17 additional nations took part. Finally, throughout the course of their operation, the threat actors targeted around 7,000 users, demanding a total ransom of more than 200 million euros.