The REvil ransomware gang's latest message is: "A server with the specified hostname could not be found." That's what appeared on the Russian hackers' sites on the dark web Tuesday, CNBC reports. The group's sites had been active and were used in negotiating with its victims and taking their payments; REvil attacked a US software company just before the Fourth of July holiday weekend, taking down companies around the world. The gang's public spokesperson hasn't shown up on message boards since Thursday, and a cybersecurity analyst said REvil's infrastructure is down, as well, per Politico. The reason wasn't clear. Even its list of victims is gone, per the New York Times.
After the holiday attack, President Biden endorsed the idea of an attack on the servers used in ransomware attacks, and a National Security Council official said last week that the US would act soon. Biden has also insisted that Russian President Vladimir Putin move against the hackers. An analyst listed several possible reasons for the sites going down, all of which would be intentional. "Evidence suggests REvil has suffered a planned, concurrent takedown of their infrastructure, either by the operators themselves or via industry or law enforcement action," he said. Battles within a gang sometimes cause disruptions, and it's also possible that the group will resurface later under a different name. If REvil was attacked, the analyst said, answers may not ever surface. (Read more ransomware stories.)