Operation GoldDust Arrests REvil Affiliates and Disrupts Ransomware Network

Romanian authorities arrested two suspected Sodinokibi/REvil affiliates as part of Operation GoldDust, a multinational law-enforcement campaign targeting operators tied to both REvil and GandCrab. Europol said the suspects were linked to roughly 5,000 infections and about €500,000 in ransom payments, while the broader group of arrested affiliates was suspected of around 7,000 infections and demands exceeding €200 million. Since February 2021, authorities in 17 countries, working with Europol, Eurojust, and INTERPOL, had arrested seven suspects connected to the two ransomware families, including a REvil affiliate associated with the Kaseya supply-chain attack and other suspects detained in South Korea and Kuwait.

The arrests followed wider pressure on REvil’s ransomware-as-a-service operation after its infrastructure was disrupted and its public-facing sites went offline. Reporting indicated the gang shut down after U.S. Cyber Command hijacked one of its sites and the operators realized they had been compromised, adding to the strain from coordinated international investigations. Europol said private-sector partners including Bitdefender, KPN, and McAfee Enterprise supported the operation with technical analysis and decryptors distributed through No More Ransom, enabling more than 50,000 decryptions, helping over 1,400 companies recover from REvil infections, and preventing losses worth hundreds of millions of euros.