July 05, 2021
A man types on a computer keyboard in Warsaw in this February 28, 2013 illustration file picture. REUTERS/Kacper Pempel/File Photo
By Raphael Satter | REUTERS
WASHINGTON – Hackers suspected to be behind a mass extortion attack that affected hundreds of companies worldwide late on Sunday demanded $70 million to restore the data they are holding ransom, according to a posting on a dark web site.
The demand was posted on a blog typically used by the REvil cybercrime gang, a Russia-linked group that is counted among the cybercriminal world’s most prolific extortionists.
The gang has an affiliate structure, occasionally making it difficult to determine who speaks on the hackers’ behalf, but Allan Liska of cybersecurity firm Recorded Future said the message “almost certainly” came from REvil’s core leadership.
The group has not responded to an attempt by Reuters to reach it for comment.
REvil’s ransomware attack, which the group executed on Friday, was among the most dramatic in a series of increasingly attention-grabbing hacks.
The gang broke into Kaseya, a Miami-based information technology firm, and used their access to breach some of its clients’ clients, setting off a chain reaction that quickly paralyzed the computers of hundreds of firms worldwide.
Cybersecurity experts swiftly blamed REvil for the attack. Sunday’s statement was the group’s first public acknowledgement that it was behind it.
An executive at Kaseya said the company was aware of the ransom demand but did not immediately return further messages seeking comment.
Liska said he believed the hackers had bitten off more than they could chew.
“For all of their big talk on their blog, I think this got way out of hand and is a lot bigger than they expected,” he said.
(Reporting by Raphael Satter; Editing by Kim Coghill, Robert Birsel)