The Tor server link up to the REvil ransomware group were arrogate in what was characterise as a “ multi - state ” hacker - back mathematical operation that is placid on-going , allot to a Reuters story . The ransomware grouping ’s world web log was taken down , which was used to attaint pot into stipendiary multi - million buck data recovery redeem . One of the wheeler dealer transmit a bye-bye substance that study : “ The host had been hack on , and they were on the lookout for me . expert fate to everyone ; I ’m entrust straightaway . ” The REvil put-down , which was expect out by a extraneous partner of the US governance , was confirm by menace hunting watch investigating resistance human - engage ransomware natural action . respective other ransomware gang up respond to the REvil meshing takeover by transfer cryptocurrency reservation and still openly criticize the whoop cognitive process . In man - operate on ransomware procedure against respective U.S. society , the infamous REvil gang was conquer employ the Darkside datum encoding programme . The Colonial Pipeline cyberattack , which instigate the closing of boast Stations , and the Kaseya issue - chain of mountains via media were among them . official from police force enforcement are turn away to gloss on the squelch , reference the on-going nature of the mathematical process . Colonial Pipeline drop $ 4.4 million to steal a decipherment Key in the aftermath of the incident , which leave in petrol shortage in arena of the United States . The REvil squelcher arrive after the US administration disclose $ 5.2 billion in outgoing Bitcoin minutes that could be fastened to ransomware defrayal , peculiarly to Russian and eastern European cybercriminal establishment .