R is for REvil — The Ransomware Russia Arrested, Then Abandoned

The Alphabet of Actors — Letter R. A named-entity dossier: who they are in the record, what the LSN systems catch of their kind today, and a status verdict — ACTIVE, DEFUNCT, REBRANDED, PROSECUTED, ABSORBED, INDICTED, DISBANDED, EXPOSED, DISSOLVED, UNDETERRED, NORMALIZED, SANCTIONED, CAUGHT, EVOLVING, TAKEN DOWN, IMMORTAL, LIABLE, UNMASKED, NAMED, UNINSTALLED, ARRESTED.

The last letter ended on a hopeful note the register rarely gets to strike: QakBot showed that operational action can actually land, that a botnet can be reached and switched off, that consequence is not always a fantasy. This letter is the reply, and it is colder. REvil is the actor that was reached — genuinely arrested, its members raided by their own government, its infrastructure hacked back offline — and then, weeks later, let go, because the arrest had never really been about justice. It was about diplomacy, and when the diplomacy died, so did the case. QakBot proved consequence can be real. REvil proves that against a state-sheltered crew, even a real arrest can be revoked by statecraft.

REvil, also called Sodinokibi, was for a stretch of 2020 and 2021 the most audacious ransomware brand on earth. It ran as a service, renting its ransomware to affiliates who broke into networks and split the proceeds, and it built a résumé of victims that reads like a stress test of modern society: a currency exchange, a computer manufacturer, the contractor that builds Apple's laptops, the world's largest meat processor, and — its masterpiece of leverage — a single piece of trusted IT-management software through which it reached roughly fifteen hundred businesses in one weekend. Then it demanded seventy million dollars for the key. It was, in the language of the archive, one of the two most costly ransomware variants of its era.

This is the letter about ransomware as a supply-chain weapon, about a crew that operated from behind a border that protected it, and about the strangest twist in the whole register: the one time a hostile government actually arrested the criminals the West wanted — and then, when the geopolitics turned, quietly made the whole thing disappear.

1. The Actor: extortion as a rented service

To understand REvil you have to understand the business model, because the model is what made it scale and what made it slippery. REvil did not, for the most part, break into victims itself. It ran ransomware-as-a-service: a core team built and maintained the encryption malware, the payment infrastructure, the leak site where stolen data was published to pressure victims, and the negotiation apparatus — and then rented all of it to affiliates. The affiliates did the intrusions, deployed the ransomware, and split the ransom with the core, typically keeping the larger share. It was a franchise, and like any franchise it multiplied the brand's reach far beyond what a single crew could manage.

Two features of the operation tell you what it really was. The first is technical competence at the end-stage, documented so thoroughly in this archive that REvil's playbook lives in the detection rules written to catch it: deleting Windows Volume Shadow Copies so victims cannot restore from backup, exfiltrating data with the RClone utility before encrypting so that refusal to pay could be answered with publication — the double-extortion model — and abusing scheduled tasks and legitimate system tools to move and persist. This is disciplined, repeatable extortion engineering, refined across hundreds of intrusions.

The second feature tells you where it lived. REvil's malware included checks that avoided encrypting systems in Russia and other Commonwealth of Independent States countries — a built-in geographic exemption that spared its home region. That is not a technical necessity; it is a survival strategy, and it is the tell of Russia-tolerated cybercrime. An operation that carefully never robs at home, and is never seriously troubled by the authorities at home, is operating under an unwritten arrangement: prey on the outside world as you like, so long as you leave the home country alone. REvil was a business, but it was a business with a flag-shaped hole in its target map, and that hole is the whole geopolitics of the letter compressed into a line of code.

2. The Masterpiece: one compromise, fifteen hundred victims

REvil's defining attack, and the reason it earns its letter over a dozen other ransomware brands, is Kaseya — because Kaseya was not one break-in but a demonstration of a principle that should frighten anyone who depends on software, which is everyone.

Over the July 4th weekend of 2021, REvil compromised Kaseya's VSA platform. VSA is remote-monitoring-and-management software: the tool that managed service providers — the outsourced IT departments that thousands of small and medium businesses rely on — use to administer their clients' networks at scale. It is, by design, trusted software with deep access to many downstream systems. REvil turned that trust into a delivery mechanism. By compromising the platform, it pushed its ransomware through the MSPs and out to their customers, encrypting an estimated fifteen hundred businesses worldwide from a single upstream breach. Then it posted its demand: seventy million dollars for a universal decryptor that would unlock all of them at once — the largest publicly known ransom demand in history at the time.

This is the structural insight the letter exists to deliver, and it generalizes far beyond REvil. The software supply chain is a force multiplier for attackers exactly because it is a force multiplier for everyone: we build efficiency by trusting shared platforms, and every shared platform is a shared point of failure. Espionage learned this lesson at SolarWinds; REvil proved ransomware had learned it too. You do not need to breach fifteen hundred companies if you can breach the one piece of software all fifteen hundred trust. The FinCEN advisory in this archive records the event in the flat language of a regulator — Sodinokibi/REvil attacked Kaseya, affecting hundreds of organizations including multiple managed service providers and their customers — and the crime YARA rule that fingerprints the Kaseya malware sits in the same archive. Between them they mark the moment ransomware became a supply-chain weapon.

3. The Victims: currency, computers, and the food supply

Kaseya was the leverage masterpiece, but REvil's broader victim list is what moved it from expensive crime to systemic threat, so this section names the targets, because the names are the argument.

Before Kaseya there was Travelex, the foreign-exchange company REvil crippled over the 2019-2020 New Year, reportedly extracting a multi-million-dollar payment and taking the firm's systems down for weeks. There was Acer, the computer manufacturer, hit with one of the largest ransom demands of its time. There was Quanta Computer, a contractor that manufactures hardware for Apple, where REvil stole product schematics and, when Quanta would not pay, tried to extort Apple directly with the blueprints. And there was JBS — the largest meat-processing company on the planet — struck in mid-2021 with disruption across operations in multiple countries, a hit serious enough that JBS reported paying approximately eleven million dollars to make it stop.

Read that list as a category shift. A ransomware crew that locks a law firm or a school district is committing serious crime against individual organizations. A crew that disrupts the world's largest meat processor is touching the food supply; a crew that reaches fifteen hundred businesses through their shared IT software is touching the connective tissue of the economy. REvil crossed the line from criminal nuisance to systemic risk, and it did so from behind a border, renting its capability to whoever could break in, taking a cut of every ransom. The victims were in London, in Taiwan, in Brazil and the American Midwest and everywhere fifteen hundred small businesses happened to sit. The operators were somewhere the victims' governments could not reach — or so it seemed, until the strangest chapter of the story.

4. The Reckoning That Wasn't: arrested, then abandoned

For a moment at the end of 2021 and the start of 2022, it looked as though REvil would be the exception — the ransomware crew that actually faced consequence at the source. What happened instead is the darkest lesson in this letter, so it must be told precisely.

After the Kaseya attack, the pressure became extraordinary, and it produced real action. REvil's infrastructure went dark; when it tried to return, a multi-country operation — with reported United States involvement in compromising REvil's own Tor infrastructure, using the operators' own backups against them — forced the brand offline. This was consequence: not a press release, but a hack-back that took the criminals' servers away from them. And then, in January 2022, came the astonishment: Russia's FSB, the security service that had spent years tolerating exactly this kind of operation, announced that it had raided REvil at the request of the United States, arresting members and seizing cash, cryptocurrency and luxury cars. For a moment, the impossible had happened. The state that shelters ransomware had reached in and arrested the sheltered.

Then Russia invaded Ukraine, and the moment evaporated. Within weeks of the arrests, the February 2022 invasion collapsed United States–Russia law-enforcement cooperation entirely, and the REvil case in Russia — the arrests that had briefly looked like a breakthrough — was effectively abandoned, its promise dissolving into the wreckage of the broader relationship. The arrests, it became clear in hindsight, had never been an act of justice. They had been an act of diplomacy — a bargaining chip Moscow offered Washington during a tense negotiation, a gesture of good faith at a moment when Russia had reasons to appear cooperative. When Russia decided on war instead, the gesture was worthless, and the chip was simply pocketed. The men who had been arrested for show had no reason to fear a system that had only ever been performing. This is the letter's hardest truth: against a crew the state chooses to shelter, an arrest is not an ending. It is a move in a larger game, and it can be un-made the instant the game changes.

5. The One Who Was Reachable

The story is not one of total impunity, and honesty requires the exception, because it proves the rule the register keeps finding: consequence lands on whoever is physically within reach of a cooperating court, and stops at the border of a hostile one.

While the Russia-based core was being arrested for show and quietly released, a different figure faced the real thing. Yaroslav Vasinskyi, a Ukrainian national and REvil affiliate, was arrested — not in Russia, but in Poland, in October 2021. Poland extradited him to the United States. And there, in an actual courtroom, with an actual trial process, he was convicted for his role in the Kaseya attack and, in 2024, sentenced to more than thirteen years in prison with an order to pay millions in restitution. That is adjudicated justice: a real conviction, a real sentence, a real number. It is the genuine article, and it belongs in the record exactly because it is so rare.

But notice where it landed, because the geography is the whole point. Vasinskyi was reachable — an affiliate who stepped into a cooperating jurisdiction and was caught there. The core operators, sheltered inside Russia, were not reachable, and their January 2022 arrests were theater that dissolved on contact with geopolitics. The same operation produced two opposite outcomes, and the variable that decided them was not culpability or evidence but location. Step outside the protecting border and the law can hold you; stay inside it and the law can, at most, be invited in for a photo opportunity that means nothing. Vasinskyi is not a counterexample to the letter's thesis. He is its proof. The reachable affiliate went to prison for over a decade. The sheltered core went back to whatever it does now, and the case against it is a folder no one will ever open again.

6. The counter-narrative, steelmanned

There is a real case that this letter is too cynical about the January 2022 arrests, and it deserves its strongest form.

The argument runs like this. The arrests were not nothing, and treating them as pure theater is a hindsight distortion. At the time they happened, they were a genuine act: real raids, real seizures of cash and crypto and vehicles, real disruption of an operation that had been running with impunity. The people arrested were, for a period, actually in custody. That the geopolitical situation later collapsed does not retroactively make the arrests fake — it makes them a casualty of an unforeseeable war. And more broadly, the argument goes, the REvil story is actually one of the ransomware ecosystem's clearer wins for the good guys: the brand was hacked offline, its infrastructure taken, an affiliate convicted to thirteen years, and its most famous incarnation never truly recovered. To file REvil under "impunity" is to ignore a substantial record of real cost imposed. The pessimism, on this view, is a pose that undervalues genuine law-enforcement achievement.

The dossier grants the facts and rejects the framing. Yes, the hack-back was real, the seizures were real, and Vasinskyi's thirteen years are entirely real — the letter states all three plainly and credits them, because refusing to acknowledge genuine wins would be the mirror-image dishonesty of triumphalism. But the counter-narrative's central move is to treat the January 2022 arrests as a good-faith law-enforcement action interrupted by bad luck, and the evidence does not support that generosity. An operation that had sheltered REvil for years does not suddenly discover the rule of law the same season it needs a bargaining chip with Washington; the timing, the framing "at US request," and the total abandonment the moment cooperation ended all point to a gesture, not a conversion. The war did not spoil a sincere prosecution — it revealed the arrests' actual nature by removing the only reason they were staged. And the deeper point stands regardless of how one reads Moscow's motives: the durable consequence in this whole story landed on the one man who was outside Russia, and none landed on the ones inside it. Whether the January arrests were cynical from the start or merely abandoned when convenient, the outcome is identical, and it is the outcome the register is obliged to weigh. Real cost was imposed on the reachable. The sheltered were, in the end, untouched.

7. Verdict — ARRESTED, and ABANDONED

REvil turned extortion into a franchise and the software supply chain into a weapon, reaching fifteen hundred businesses through one trusted platform, disrupting the world's food supply, and demanding the largest ransom in history — all from behind a border that carefully exempted itself from its own malware's reach. It was, for two years, the most audacious ransomware brand alive, and then it became the register's clearest study in how consequence behaves when the criminal is a guest of a hostile state.

The verdict's first word is the one that briefly promised an ending this register almost never delivers: ARRESTED. This was not indictment-in-absentia or naming-and-shaming. REvil was hacked offline by a real operation, and then its members were raided and detained by their own government's security service, cash and crypto and cars seized, in January 2022. For a few weeks, the sheltered had been reached. It was the most that pressure on Russia-based ransomware had ever visibly achieved.

The second word is what that achievement was worth: ABANDONED. Weeks after the arrests, Russia invaded Ukraine, cooperation collapsed, and the case dissolved — revealed, in the collapse, as the diplomatic gesture it had always been rather than the justice it had briefly resembled. The arrests were a bargaining chip, and when Moscow chose war over cooperation, the chip was simply withdrawn. The one durable conviction went to Vasinskyi, the affiliate reachable in Poland, sentenced to thirteen years in a real American courtroom; the Russia-sheltered core went back to the shadows with a closed folder behind them. Consequence landed on the reachable and evaporated at the hostile border, exactly as it always does.

Twenty letters deep, REvil is the register's reply to its own moment of hope. QakBot showed that consequence can be genuine — a botnet switched off, victims cleaned. REvil shows that genuineness is not enough when the target lives behind a state that treats its criminals as assets: the servers can be seized, the affiliate can be jailed, the operators can even be arrested, and still the core can walk, because the arrest was never the point. The honeypot beneath these words will never see the Kaseya compromise — a supply-chain strike on a software vendor is nothing a honeypot sits astride — but it lives at the base of the same funnel REvil's affiliates fed from, the endless credential-access pressure that the ransomware economy converts into breaches, and the commodity end-stage playbook, the shadow-copy deletion and the RClone exfiltration, is the tradecraft that trickled down from crews like this one to every affiliate on every network. The vectors do not lie: the leverage was real, the food supply was hit, the arrests happened, and the arrests were undone. Judge the franchise that made extortion a supply-chain weapon. Then judge the arrangement that let it operate, arrested it for show, and abandoned the case the moment a war made the performance pointless — and note that the only person still paying for any of it is the one who happened to be standing in Poland.

The Alphabet of Actors continues. Verdict: ARRESTED, and ABANDONED. Confidence: HIGH on REvil's attacks (Kaseya, JBS, Travelex, Acer, Quanta), the RaaS/CIS-exclusion structure, and the Vasinskyi conviction (adjudicated fact); the January 2022 FSB arrests and the reported hack-back are matters of public record but their ultimate internal outcomes in Russia are murky and are not overclaimed here. Classification: TLP:WHITE. Include everything — the vectors do not lie, and they do not judge. The reader judges the supply-chain weapon, the border that sheltered it, and the difference between an arrest that is justice and an arrest that is a bargaining chip.