Russian Authorities Say They’ve Dismantled REvil Ransomware Group at US Request

The FSB raided 25 residences, seizing approximately $6.8 million in various currencies including cryptocurrencies.

AccessTimeIconJan 18, 2022 at 7:52 p.m. UTC
Updated May 11, 2023 at 6:34 p.m. UTC

Russia’s top domestic intelligence agency says REvil – the Russia-based ransomware gang tied to the Colonial Pipeline attack – has “ceased to exist” after the agency arrested 14 alleged members of the criminal organization last week.

The Federal Security Service (FSB) raided 25 residences tied to REvil, seizing approximately $6.8 million in various currencies – including cryptocurrencies. The FSB also seized computer equipment, crypto wallets “that were used to perpetrate crimes” and 20 luxury cars, according to a Jan. 14 press release.

The FSB said the arrests were carried out at the request of “US authorities.”

U.S. President Joe Biden has been pressing Russian authorities to act against REvil and other Russian cyber criminals since last summer, when REvil demanded $70 million in bitcoin payments after hacking Miami-based software provider Kaseya. Russia has been slow to take action. Last week’s arrests are the first time – at least publicly – that Russian authorities have acted against one of the many ransomware groups based in Russia.

It is also the first time in years that U.S. and Russian intelligence agencies teamed up on a cyber crime operation. A few observers of U.S.-Russian relations have highlighted that the timing of the arrests coincides with Russia’s escalating efforts to invade Ukraine.

A White House official speaking on the condition of anonymity told reporters last Friday that the U.S. did not consider the arrests to be related to the ongoing events in Ukraine.

Russia’s motives for tackling REvil aside, the arrests are part of an uptick in global collaboration against ransomware gangs. Last year, Romanian, Kuwaiti and South Korean authorities independently arrested suspected members of REvil-affiliated hacking groups.

The momentum has continued into this year.

On Jan. 17, Europol announced that it had seized 15 servers belonging to, a virtual private network provider that catered to cyber criminals and ransomware gangs, rendering the company’s virtual private network (VPN) services inoperable.

UPDATE (January 25, 2022, 4:26 UTC): Updates information that REvil demanded $70 million in ransom.


Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

The leader in news and information on cryptocurrency, digital assets and the future of money, CoinDesk is a media outlet that strives for the highest journalistic standards and abides by a strict set of editorial policies. CoinDesk is an independent operating subsidiary of Digital Currency Group, which invests in cryptocurrencies and blockchain startups. As part of their compensation, certain CoinDesk employees, including editorial employees, may receive exposure to DCG equity in the form of stock appreciation rights, which vest over a multi-year period. CoinDesk journalists are not allowed to purchase stock outright in DCG.

CoinDesk - Unknown

Cheyenne Ligon is a CoinDesk news reporter with a focus on crypto regulation and policy. She has no significant crypto holdings.

Learn more about Consensus 2024, CoinDesk’s longest-running and most influential event that brings together all sides of crypto, blockchain and Web3. Head to to register and buy your pass now.