The Russian-linked hacking outfit blamed for a sprawling July ransomware campaign has vanished from its dark-web home. According to a report from Tech Xplore citing researchers at Recorded Future and Mandiant, the group's leak site stopped responding around 0500 GMT on Tuesday, roughly two weeks after the attack on U.S. Software vendor Kaseya rippled through managed service providers and downstream customers in at least 17 countries.
The same attack triggered a $70 million ransom demand and forced a major Swedish supermarket chain, plus pharmacies, petrol stations, and New Zealand kindergartens, to shut doors or stall operations. With REvil's public storefront now offline, victims mid-negotiation may be left holding encrypted data and no working email thread to the criminals who hold the key.
- Who vanished: REvil, the group blamed for the Kaseya ransomware attack reported on July 2.
- How many hit: roughly 1,500 businesses affected worldwide, across at least 17 countries.
- Ransom ask: $70 million, the largest publicly linked to this incident.
- When the site went dark: around 0500 GMT, roughly two weeks after the attack.
- Why now: the disappearance comes days after President Joe Biden publicly warned Russia's Vladimir Putin again about harboring cybercriminals.
What we know about the takedown
Recorded Future researcher Allan Liska tweeted that the group's leak portal appeared to go offline, with no response from the server. John Hultquist of Mandiant Threat Intelligence told Tech Xplore that evidence points to a coordinated removal of the group's infrastructure, though whether that removal was self-inflicted, the work of industry partners, or a law enforcement action remains unconfirmed. Brett Callow of Emsisoft added a sharp caveat: if police pulled the plug, victims who had not yet paid may now have no path to a decryption key from REvil, even if they wanted one.
That last point matters. In modern ransomware cases, the attacker often doubles as the support desk. Pull the attacker offline, and you can also pull the only recovery channel some victim companies were counting on.
Why this matters
Big ransomware crews rarely disappear for long without a reason. The standard playbook is rebranding: same operators, new name, fresh leak site, business as usual. A quiet exit in the middle of an active extortion campaign is the unusual bit. It hints at pressure, whether from Moscow, Washington, or REvil's own leadership deciding the heat was too high.
The trade-off is sharp: if law enforcement did act, victims who hadn't paid may lose access to the only entity capable of decrypting their data. Emsisoft's Callow put it plainly—if police disrupted the gang's operations, companies currently locked out of their own systems might have no option left but to rebuild from backups or accept permanent loss.
For everyday readers, the lesson is not to celebrate too early. The ransomware model that fuels groups like REvil is a service economy. Affiliate hackers rent the encryption tools, keep a cut of the ransom, and move on to the next crew when one brand gets burned. The infrastructure can be rebuilt. The tradecraft does not need to be.
Who should care
| Group | Why they should pay attention |
|---|---|
| Businesses hit by Kaseya | May lose negotiating channel; recovery now depends on backups or law enforcement disclosure |
| Managed service providers | Attack vector (software supply chain) remains open for copycats |
| Small businesses with single IT vendor | Particularly exposed if that vendor was compromised |
| Cybersecurity teams | Takedown method (coordinated removal) suggests either new law enforcement capability or internal splits worth monitoring |
What to watch next
Watch for the victims of the Kaseya attack to start publishing recovery timelines in the coming weeks. If REvil resurfaced under a new name within 30 days, this disappearance was almost certainly a rebrand. If something stayed offline through the autumn, that would be the more meaningful signal. Either way, expect copycat affiliates to keep hitting small businesses through the same software supply chain tricks, because that playbook still pays.
Key takeaways
- REvil's dark-web site went offline about two weeks after the Kaseya attack affected roughly 1,500 businesses in at least 17 countries.
- Researchers say the takedown was likely coordinated, but no one has confirmed whether police, the operators, or a third party pulled the plug.
- Victims mid-negotiation may now have no path to a decryption key from the group that holds it—a risk highlighted by Emsisoft's Brett Callow.
- The affiliate model behind groups like REvil means new brands tend to appear quickly after takedowns.
- Keep backups offline, verify vendor software updates, and treat any ransomware crew "going dark" as a breather, not a victory.
Frequently asked questions
Who is REvil?
REvil is a Russia-linked hacking group blamed for the July 2 ransomware attack on U.S. Software vendor Kaseya. The group runs a ransomware-as-a-service operation, renting its encryption tools to affiliate hackers in exchange for a cut of paid ransoms.
How many companies were hit by the Kaseya attack?
According to Tech Xplore's reporting, the attack affected roughly 1,500 businesses across at least 17 countries, reaching victims through managed service providers that use Kaseya's software.
Why did REvil's site go offline?
Researchers at Recorded Future and Mandiant told Tech Xplore the disappearance looked coordinated, but no party has publicly claimed responsibility. Possibilities include police action, industry disruption, or the operators pulling the plug themselves.
Does this mean ransomware is going away?
No. The technical and business model behind ransomware, affiliate hackers renting encryption tools, remains intact. Expect rebrands, copycat crews, and continued targeting of software supply chains.
What should a small business do right now?
Keep verified, offline backups. Vet any software update that comes through a managed vendor. Limit admin rights on endpoints. And have an incident response plan that does not depend on paying the attacker for a key.